Skip to content

Commit 45599e0

Browse files
pyth0n1cpyth0n1c
committed
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
1 parent 9dc252d commit 45599e0

File tree

871 files changed

+3873
-3541
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

871 files changed

+3873
-3541
lines changed

Diff for: ‎detections/application/detect_distributed_password_spray_attempts.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Distributed Password Spray Attempts
22
id: b1a82fc8-8a9f-4344-9ec2-bde5c5331b57
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: Hunting
@@ -65,7 +65,6 @@ tags:
6565
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
6666
mitre_attack_id:
6767
- T1110.003
68-
- T1110
6968
product:
7069
- Splunk Enterprise
7170
- Splunk Enterprise Security

Diff for: ‎detections/application/detect_password_spray_attempts.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Password Spray Attempts
22
id: 086ab581-8877-42b3-9aee-4a7ecb0923af
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -83,7 +83,6 @@ tags:
8383
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
8484
mitre_attack_id:
8585
- T1110.003
86-
- T1110
8786
product:
8887
- Splunk Enterprise
8988
- Splunk Enterprise Security

Diff for: ‎detections/application/email_files_written_outside_of_the_outlook_directory.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Email files written outside of the Outlook directory
22
id: 8d52cf03-ba25-4101-aa78-07994aed4f74
3-
version: 6
4-
date: '2025-01-21'
3+
version: 7
4+
date: '2025-02-10'
55
author: Bhavin Patel, Splunk
66
status: experimental
77
type: TTP
@@ -44,7 +44,6 @@ tags:
4444
- Collection and Staging
4545
asset_type: Endpoint
4646
mitre_attack_id:
47-
- T1114
4847
- T1114.001
4948
product:
5049
- Splunk Enterprise

Diff for: ‎detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Email servers sending high volume traffic to hosts
22
id: 7f5fb3e1-4209-4914-90db-0ec21b556378
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Bhavin Patel, Splunk
66
status: experimental
77
type: Anomaly
@@ -51,7 +51,6 @@ tags:
5151
- HAFNIUM Group
5252
asset_type: Endpoint
5353
mitre_attack_id:
54-
- T1114
5554
- T1114.002
5655
product:
5756
- Splunk Enterprise

Diff for: ‎detections/application/okta_authentication_failed_during_mfa_challenge.yml

+3-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Authentication Failed During MFA Challenge
22
id: e2b99e7d-d956-411a-a120-2b14adfdde93
3-
version: 4
4-
date: '2025-01-21'
3+
version: 5
4+
date: '2025-02-10'
55
author: Bhavin Patel, Splunk
66
data_source:
77
- Okta
@@ -59,10 +59,8 @@ tags:
5959
- Okta Account Takeover
6060
asset_type: Okta Tenant
6161
mitre_attack_id:
62-
- T1586
63-
- T1586.003
64-
- T1078
6562
- T1078.004
63+
- T1586.003
6664
- T1621
6765
product:
6866
- Splunk Enterprise

Diff for: ‎detections/application/okta_multi_factor_authentication_disabled.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Multi-Factor Authentication Disabled
22
id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Mauricio Velazco, Splunk
66
data_source:
77
- Okta
@@ -57,7 +57,6 @@ tags:
5757
- Okta Account Takeover
5858
asset_type: Okta Tenant
5959
mitre_attack_id:
60-
- T1556
6160
- T1556.006
6261
product:
6362
- Splunk Enterprise

Diff for: ‎detections/application/okta_new_api_token_created.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta New API Token Created
22
id: c3d22720-35d3-4da4-bd0a-740d37192bd4
3-
version: 6
4-
date: '2025-01-21'
3+
version: 7
4+
date: '2025-02-10'
55
author: Michael Haag, Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -54,7 +54,6 @@ tags:
5454
- Okta Account Takeover
5555
asset_type: Okta Tenant
5656
mitre_attack_id:
57-
- T1078
5857
- T1078.001
5958
product:
6059
- Splunk Enterprise

Diff for: ‎detections/application/okta_new_device_enrolled_on_account.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta New Device Enrolled on Account
22
id: bb27cbce-d4de-432c-932f-2e206e9130fb
3-
version: 6
4-
date: '2025-01-21'
3+
version: 7
4+
date: '2025-02-10'
55
author: Michael Haag, Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -54,7 +54,6 @@ tags:
5454
- Okta Account Takeover
5555
asset_type: Okta Tenant
5656
mitre_attack_id:
57-
- T1098
5857
- T1098.005
5958
product:
6059
- Splunk Enterprise

Diff for: ‎detections/application/okta_phishing_detection_with_fastpass_origin_check.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Phishing Detection with FastPass Origin Check
22
id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3
3-
version: 4
4-
date: '2025-01-21'
3+
version: 5
4+
date: '2025-02-10'
55
author: Okta, Inc, Michael Haag, Splunk
66
type: TTP
77
status: experimental
@@ -38,7 +38,6 @@ tags:
3838
- Okta Account Takeover
3939
asset_type: Infrastructure
4040
mitre_attack_id:
41-
- T1078
4241
- T1078.001
4342
- T1556
4443
product:

Diff for: ‎detections/application/okta_successful_single_factor_authentication.yml

+3-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Successful Single Factor Authentication
22
id: 98f6ad4f-4325-4096-9d69-45dc8e638e82
3-
version: 4
4-
date: '2025-01-21'
3+
version: 5
4+
date: '2025-02-10'
55
author: Bhavin Patel, Splunk
66
data_source:
77
- Okta
@@ -55,10 +55,8 @@ tags:
5555
- Okta Account Takeover
5656
asset_type: Okta Tenant
5757
mitre_attack_id:
58-
- T1586
59-
- T1586.003
60-
- T1078
6158
- T1078.004
59+
- T1586.003
6260
- T1621
6361
product:
6462
- Splunk Enterprise

Diff for: ‎detections/application/okta_suspicious_activity_reported.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Suspicious Activity Reported
22
id: bfc840f5-c9c6-454c-aa13-b46fd0bf1e79
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -55,7 +55,6 @@ tags:
5555
- Okta Account Takeover
5656
asset_type: Okta Tenant
5757
mitre_attack_id:
58-
- T1078
5958
- T1078.001
6059
product:
6160
- Splunk Enterprise

Diff for: ‎detections/application/okta_threatinsight_threat_detected.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta ThreatInsight Threat Detected
22
id: 140504ae-5fe2-4d65-b2bc-a211813fbca6
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Michael Haag, Mauricio Velazco, Splunk
66
status: production
77
type: Anomaly
@@ -56,7 +56,6 @@ tags:
5656
- Okta Account Takeover
5757
asset_type: Infrastructure
5858
mitre_attack_id:
59-
- T1078
6059
- T1078.004
6160
product:
6261
- Splunk Enterprise

Diff for: ‎detections/application/suspicious_email_attachment_extensions.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Suspicious Email Attachment Extensions
22
id: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084
3-
version: 6
4-
date: '2025-01-21'
3+
version: 7
4+
date: '2025-02-10'
55
author: David Dorsey, Splunk
66
status: experimental
77
type: Anomaly
@@ -48,7 +48,6 @@ tags:
4848
asset_type: Endpoint
4949
mitre_attack_id:
5050
- T1566.001
51-
- T1566
5251
product:
5352
- Splunk Enterprise
5453
- Splunk Enterprise Security

Diff for: ‎detections/application/windows_ad_dangerous_deny_acl_modification.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Dangerous Deny ACL Modification
22
id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -76,9 +76,8 @@ tags:
7676
- Sneaky Active Directory Persistence Tricks
7777
asset_type: Endpoint
7878
mitre_attack_id:
79-
- T1484
80-
- T1222
8179
- T1222.001
80+
- T1484
8281
product:
8382
- Splunk Enterprise
8483
- Splunk Enterprise Security

Diff for: ‎detections/application/windows_ad_dangerous_group_acl_modification.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Dangerous Group ACL Modification
22
id: 59b0fc85-7a0d-4585-97ec-06a382801990
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -85,9 +85,8 @@ tags:
8585
- Sneaky Active Directory Persistence Tricks
8686
asset_type: Endpoint
8787
mitre_attack_id:
88-
- T1484
89-
- T1222
9088
- T1222.001
89+
- T1484
9190
product:
9291
- Splunk Enterprise
9392
- Splunk Enterprise Security

Diff for: ‎detections/application/windows_ad_dangerous_user_acl_modification.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Dangerous User ACL Modification
22
id: ec5b6790-595a-4fb8-ad43-56e5b55a9617
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -82,9 +82,8 @@ tags:
8282
- Sneaky Active Directory Persistence Tricks
8383
asset_type: Endpoint
8484
mitre_attack_id:
85-
- T1484
86-
- T1222
8785
- T1222.001
86+
- T1484
8887
product:
8988
- Splunk Enterprise
9089
- Splunk Enterprise Security

Diff for: ‎detections/application/windows_ad_domain_root_acl_deletion.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Domain Root ACL Deletion
22
id: 3cb56e57-5642-4638-907f-8dfde9afb889
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -75,9 +75,8 @@ tags:
7575
- Sneaky Active Directory Persistence Tricks
7676
asset_type: Endpoint
7777
mitre_attack_id:
78-
- T1484
79-
- T1222
8078
- T1222.001
79+
- T1484
8180
product:
8281
- Splunk Enterprise
8382
- Splunk Enterprise Security

Diff for: ‎detections/application/windows_ad_domain_root_acl_modification.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Domain Root ACL Modification
22
id: 4981e2db-1372-440d-816e-3e7e2ed74433
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -75,9 +75,8 @@ tags:
7575
- Sneaky Active Directory Persistence Tricks
7676
asset_type: Endpoint
7777
mitre_attack_id:
78-
- T1484
79-
- T1222
8078
- T1222.001
79+
- T1484
8180
product:
8281
- Splunk Enterprise
8382
- Splunk Enterprise Security

Diff for: ‎detections/application/windows_ad_gpo_new_cse_addition.yml

+3-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD GPO New CSE Addition
22
id: 700c11d1-da09-47b2-81aa-358c143c7986
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -64,10 +64,8 @@ tags:
6464
- Sneaky Active Directory Persistence Tricks
6565
asset_type: Endpoint
6666
mitre_attack_id:
67-
- T1484
68-
- T1484.001
69-
- T1222
7067
- T1222.001
68+
- T1484.001
7169
product:
7270
- Splunk Enterprise
7371
- Splunk Enterprise Security

Diff for: ‎detections/application/windows_ad_hidden_ou_creation.yml

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Hidden OU Creation
22
id: 66b6ad5e-339a-40af-b721-dacefc7bdb75
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -74,9 +74,8 @@ tags:
7474
- Sneaky Active Directory Persistence Tricks
7575
asset_type: Endpoint
7676
mitre_attack_id:
77-
- T1484
78-
- T1222
7977
- T1222.001
78+
- T1484
8079
product:
8180
- Splunk Enterprise
8281
- Splunk Enterprise Security

0 commit comments

Comments
 (0)