# custom_values

customized_type: Issue
value:
  title: Mimikatz DC Sync
  description: Detects Mimikatz DC sync security events
  status: experimental
  date: 2018/06/03
  author: Benjamin Delpy, Florian Roth
  references:
      - https://twitter.com/gentilkiwi/status/1003236624925413376
      - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
  tags:
      - attack.credential_access
      - attack.s0002
      - attack.t1003
  logsource:
      product: windows
      service: security
  detection:
      selection:
          EventID: 4662
          Properties: 
              - '*Replicating Directory Changes All*'
              - '*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*'
      condition: selection
  falsepositives:
      - Unkown
  level: critical


customized_type: Issue
value:
  (log_name:"Security" AND event_id:"4662" AND event_data.Properties.keyword:(*Replicating\ Directory\ Changes\ All* OR *1131f6ad\-9c07\-11d1\-f79f\-00c04fc2dcd2*))


customized_type: Issue
value:
  https://twitter.com/gentilkiwi/status/1003236624925413376
  https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mimikatz DC Sync
  description: Detects Mimikatz DC sync security events
  status: experimental
  date: 2018/06/03
  author: Benjamin Delpy, Florian Roth
  references:
      - https://twitter.com/gentilkiwi/status/1003236624925413376
      - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
  tags:
      - attack.credential_access
      - attack.s0002
      - attack.t1003
  logsource:
      product: windows
      service: security
  detection:
      selection:
          EventID: 4662
          Properties: 
              - '*Replicating Directory Changes All*'
              - '*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*'
      condition: selection
  falsepositives:
      - Unkown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  title: Active Directory User Backdoors
  description: Detects scenarios where one can control another users or computers account without having to use their credentials.
  references:
      - https://msdn.microsoft.com/en-us/library/cc220234.aspx
      - https://adsecurity.org/?p=3466
      - https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/
  author: '@neu5ron'
  tags:
      - attack.t1098
      - attack.credential_access
      - attack.persistence
  logsource:
      product: windows
      service: security
      definition1: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'
      definition2: 'Requirements: Audit Policy : DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes'
  detection:
      selection1:
          EventID: 4738
      filter1:
          AllowedToDelegateTo: null
      filter2:
          AllowedToDelegateTo: '-'
      selection2:
          EventID: 5136
          AttributeLDAPDisplayName: 'msDS-AllowedToDelegateTo'
      selection3:
          EventID: 5136
          ObjectClass: 'user'
          AttributeLDAPDisplayName: 'servicePrincipalName'
      selection4:
          EventID: 5136
          AttributeLDAPDisplayName: 'msDS-AllowedToActOnBehalfOfOtherIdentity'        
      condition: (selection1 and not 1 of filter*) or selection2 or selection3 or selection4
  falsepositives: 
      - Unknown
  level: high


customized_type: Issue
value:
  Detects scenarios where one can control another users or computers account without having to use their credentials.


customized_type: Issue
value:
  (log_name:"Security" AND ((((log_name:"Security" AND event_id:"4738" AND (NOT ((event_data.AllowedToDelegateTo:"None") OR (event_data.AllowedToDelegateTo:"\-")))) OR (event_id:"5136" AND event_data.AttributeLDAPDisplayName:"msDS\-AllowedToDelegateTo")) OR (event_id:"5136" AND event_data.ObjectClass:"user" AND event_data.AttributeLDAPDisplayName:"servicePrincipalName")) OR (event_id:"5136" AND event_data.AttributeLDAPDisplayName:"msDS\-AllowedToActOnBehalfOfOtherIdentity")))


customized_type: Issue
value:
  https://msdn.microsoft.com/en-us/library/cc220234.aspx
  https://adsecurity.org/?p=3466
  https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Active Directory User Backdoors
  description: Detects scenarios where one can control another users or computers account without having to use their credentials.
  references:
      - https://msdn.microsoft.com/en-us/library/cc220234.aspx
      - https://adsecurity.org/?p=3466
      - https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/
  author: '@neu5ron'
  tags:
      - attack.t1098
      - attack.credential_access
      - attack.persistence
  logsource:
      product: windows
      service: security
      definition1: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'
      definition2: 'Requirements: Audit Policy : DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes'
  detection:
      selection1:
          EventID: 4738
      filter1:
          AllowedToDelegateTo: null
      filter2:
          AllowedToDelegateTo: '-'
      selection2:
          EventID: 5136
          AttributeLDAPDisplayName: 'msDS-AllowedToDelegateTo'
      selection3:
          EventID: 5136
          ObjectClass: 'user'
          AttributeLDAPDisplayName: 'servicePrincipalName'
      selection4:
          EventID: 5136
          AttributeLDAPDisplayName: 'msDS-AllowedToActOnBehalfOfOtherIdentity'        
      condition: (selection1 and not 1 of filter*) or selection2 or selection3 or selection4
  falsepositives: 
      - Unknown
  level: high
  </code></pre>
  }}


customized_type: Issue
value:
  title: Potentially Sensitive Shared Resource
  description: Shared resources with loose access controls are common places that leak sensitive information.
  status: experimental
  author: Josh Brower
  tags:
      - attack.discovery
      - attack.t1135
  logsource:
      product: osquery
      definition: 'select Description,Name,Path, "601" AS qid  from shared_resources where type = 0 AND name <> "print$"";'
      qid: 601
  detection:
      selection:
          qid: 601
          column_name:
            - '*hr*'
            - '*finance*'
            - '*backup*'
            - '*www*'
      filter:
        counter: 0
      condition: selection and not filter
  falsepositives: 
      - unknown
  tasks:
      1 - Check Share Permissions: Are share permissions set to an appropriate level? They should be tied to the relevant AD Security Group.
      2 - Contact System/Service Owner: If share permissions are not appropriate, contact the system/service owner for remediation.
  level: medium


customized_type: Issue
value:
  ((osquery.columns.qid:"601" AND osquery.columns.name.keyword:(*hr* OR *finance* OR *backup* OR *www*)) AND (NOT (osquery.counter:"0")))


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Potentially Sensitive Shared Resource
  description: Shared resources with loose access controls are common places that leak sensitive information.
  status: experimental
  author: Josh Brower
  tags:
      - attack.discovery
      - attack.t1135
  logsource:
      product: osquery
      definition: 'select Description,Name,Path, "601" AS qid  from shared_resources where type = 0 AND name <> "print$"";'
      qid: 601
  detection:
      selection:
          qid: 601
          column_name:
            - '*hr*'
            - '*finance*'
            - '*backup*'
            - '*www*'
      filter:
        counter: 0
      condition: selection and not filter
  falsepositives: 
      - unknown
  tasks:
      1 - Check Share Permissions: Are share permissions set to an appropriate level? They should be tied to the relevant AD Security Group.
      2 - Contact System/Service Owner: If share permissions are not appropriate, contact the system/service owner for remediation.
  level: medium
  </code></pre>
  }}


# documents

title: test
created_on: 2019-08-25 13:41:58.688580
description:
  ``` yaml
  alert:
  - debug
  description: Detects PowerShell called from an executable by the version mismatch
    method
  filter:
  - query:
      query_string:
        query: (event_id:"400" AND event_data.EngineVersion.keyword:(2.* 4.* 5.*) AND
          event_data.HostVersion.keyword:3.*)
  index: logstash-beats-*
  name: PowerShell-called-from-an-Executable-Version-Mismatch_0
  priority: 2
  realert:
    minutes: 0
  type: any
  ```


title: Webhook?
created_on: 2019-08-26 18:43:07.873301
description:
  title: Clear Command History
  status: experimental
  description: Clear command history in linux which is used for defense evasion. 
  references:
      - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1146/T1146.yaml
      - https://attack.mitre.org/techniques/T1146/
  author: Patrick Bareiss
  date: 2019/03/24
  logsource:
      product: linux
  detection:
      keywords:
          - 'rm *bash_history'
          - 'echo "" > *bash_history'
          - 'cat /dev/null > *bash_history' 
          - 'ln -sf /dev/null *bash_history'
          - 'truncate -s0 *bash_history'
          # - 'unset HISTFILE'  # prone to false positives
          - 'export HISTFILESIZE=0'
          - 'history -c'
      condition: keywords
  falsepositives:
      - Unknown
  level: high
  tags:
      - attack.defense_evasion
      - attack.t1146


# custom_fields

type: IssueCustomField
name: Objective
field_format: text
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  text_formatting: full
  full_width_layout: '1'


type: IssueCustomField
name: Order
field_format: list
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  url_pattern: ''
  edit_tag_style: ''

possible_values:
  ---
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  - '8'
  - '9'
  - '10'
  - '11'
  - '12'
  - '13'
  - '14'
  - '15'


type: IssueCustomField
name: References
field_format: text
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  text_formatting: full
  full_width_layout: '0'


type: IssueCustomField
name: ATT&CK Technique
field_format: list
possible_values:
  ---
  - T1001
  - T1002
  - T1003
  - T1004
  - T1005
  - T1006
  - T1007
  - T1008
  - T1009
  - T1010
  - T1011
  - T1012
  - T1013
  - T1014
  - T1015
  - T1016
  - T1017
  - T1018
  - T1019
  - T1020
  - T1021
  - T1022
  - T1023
  - T1024
  - T1025
  - T1026
  - T1027
  - T1028
  - T1029
  - T1030
  - T1031
  - T1032
  - T1033
  - T1034
  - T1035
  - T1036
  - T1037
  - T1038
  - T1039
  - T1040
  - T1041
  - T1042
  - T1043
  - T1044
  - T1045
  - T1046
  - T1047
  - T1048
  - T1049
  - T1050
  - T1051
  - T1052
  - T1053
  - T1054
  - T1055
  - T1056
  - T1057
  - T1058
  - T1059
  - T1060
  - T1061
  - T1062
  - T1063
  - T1064
  - T1065
  - T1066
  - T1067
  - T1068
  - T1069
  - T1070
  - T1071
  - T1072
  - T1073
  - T1074
  - T1075
  - T1076
  - T1077
  - T1078
  - T1079
  - T1080
  - T1081
  - T1082
  - T1083
  - T1084
  - T1085
  - T1086
  - T1087
  - T1088
  - T1089
  - T1090
  - T1091
  - T1092
  - T1093
  - T1094
  - T1095
  - T1096
  - T1097
  - T1098
  - T1099
  - T1100
  - T1101
  - T1102
  - T1103
  - T1104
  - T1105
  - T1106
  - T1107
  - T1108
  - T1109
  - T1110
  - T1111
  - T1112
  - T1113
  - T1114
  - T1115
  - T1116
  - T1117
  - T1118
  - T1119
  - T1120
  - T1121
  - T1122
  - T1123
  - T1124
  - T1125
  - T1126
  - T1127
  - T1128
  - T1129
  - T1130
  - T1131
  - T1132
  - T1133
  - T1134
  - T1135
  - T1136
  - T1137
  - T1138
  - T1139
  - T1140
  - T1141
  - T1142
  - T1143
  - T1144
  - T1145
  - T1146
  - T1147
  - T1148
  - T1149
  - T1150
  - T1151
  - T1152
  - T1153
  - T1154
  - T1155
  - T1156
  - T1157
  - T1158
  - T1159
  - T1160
  - T1161
  - T1162
  - T1163
  - T1164
  - T1165
  - T1166
  - T1167
  - T1168
  - T1169
  - T1170
  - T1171
  - T1172
  - T1173
  - T1174
  - T1175
  - T1176
  - T1177
  - T1178
  - T1179
  - T1180
  - T1181
  - T1182
  - T1183
  - T1184
  - T1185
  - T1186
  - T1187
  - T1188

format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  url_pattern: https://attack.mitre.org/techniques/%value%
  edit_tag_style: ''


# imports

type: IssueImport
filename: c32da363ebee1050517ca61125f96878
created_at: 2019-06-28 20:39:19.990976
updated_at: 2019-06-28 20:40:07.491869
settings:
  ---
  separator: ","
  wrapper: "\""
  encoding: ISO-8859-1
  date_format: "%m/%d/%Y"
  mapping: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    project_id: '1'
    tracker: '2'
    status: '4'
    subject: '6'
    description: ''
    priority: ''
    category: ''
    assigned_to: ''
    fixed_version: ''
    cf_1: ''
    cf_6: ''
    cf_2: ''
    cf_7: ''
    cf_3: ''
    cf_5: ''
    cf_4: ''
    cf_8: ''
    cf_9: ''
    cf_10: ''
    cf_11: ''
    cf_12: ''
    cf_14: ''
    is_private: ''
    parent_issue_id: ''
    start_date: ''
    due_date: ''
    estimated_hours: ''
    done_ratio: ''


type: IssueImport
filename: 96833c42a8e490907fac465dc55d80b6
created_at: 2019-06-28 20:40:36.340614
updated_at: 2019-06-28 20:41:01.781417
settings:
  ---
  separator: ","
  wrapper: "\""
  encoding: ISO-8859-1
  date_format: "%m/%d/%Y"
  mapping: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    project_id: '1'
    tracker: '2'
    status: ''
    subject: '6'
    description: ''
    priority: ''
    category: ''
    assigned_to: ''
    fixed_version: ''
    cf_1: '15'
    cf_6: '16'
    cf_2: ''
    cf_7: ''
    cf_3: ''
    cf_5: ''
    cf_4: ''
    cf_8: ''
    cf_9: ''
    cf_10: ''
    cf_11: ''
    cf_12: ''
    cf_14: ''
    is_private: ''
    parent_issue_id: ''
    start_date: ''
    due_date: ''
    estimated_hours: ''
    done_ratio: ''


# roles

name: Non member
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :view_issues
  - :add_issues
  - :add_issue_notes
  - :save_queries
  - :view_gantt
  - :view_calendar
  - :view_time_entries
  - :view_news
  - :comment_news
  - :view_documents
  - :view_wiki_pages
  - :view_wiki_edits
  - :view_messages
  - :add_messages
  - :view_files
  - :browse_repository
  - :view_changesets


name: Anonymous
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :view_messages
  - :view_calendar
  - :view_documents
  - :view_files
  - :view_gantt
  - :view_news
  - :view_changesets
  - :browse_repository
  - :view_time_entries
  - :view_wiki_edits

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '0'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '0'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: SuperAdmin
issues_visibility: all
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :add_project
  - :edit_project
  - :close_project
  - :select_project_modules
  - :manage_members
  - :manage_versions
  - :add_subprojects
  - :manage_public_queries
  - :save_queries
  - :manage_hook
  - :view_messages
  - :add_messages
  - :edit_messages
  - :edit_own_messages
  - :delete_messages
  - :delete_own_messages
  - :manage_boards
  - :view_calendar
  - :view_documents
  - :add_documents
  - :edit_documents
  - :delete_documents
  - :view_files
  - :manage_files
  - :view_gantt
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :manage_issue_relations
  - :manage_subtasks
  - :set_issues_private
  - :set_own_issues_private
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :set_notes_private
  - :delete_issues
  - :view_issue_watchers
  - :add_issue_watchers
  - :delete_issue_watchers
  - :import_issues
  - :manage_categories
  - :view_news
  - :manage_news
  - :comment_news
  - :view_changesets
  - :browse_repository
  - :commit_access
  - :manage_related_issues
  - :manage_repository
  - :view_time_entries
  - :log_time
  - :edit_time_entries
  - :edit_own_time_entries
  - :manage_project_activities
  - :view_wiki_pages
  - :view_wiki_edits
  - :export_wiki_pages
  - :edit_wiki_pages
  - :rename_wiki_pages
  - :delete_wiki_pages
  - :delete_wiki_pages_attachments
  - :protect_wiki_pages
  - :manage_wiki

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Security-Analyst
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :save_queries
  - :view_issues
  - :add_issues
  - :edit_issues
  - :add_issue_notes
  - :view_private_notes

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '0'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    add_issues:
    - '6'
    view_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Admin
issues_visibility: all
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :add_project
  - :edit_project
  - :close_project
  - :select_project_modules
  - :manage_members
  - :manage_versions
  - :add_subprojects
  - :manage_public_queries
  - :save_queries
  - :view_messages
  - :add_messages
  - :edit_messages
  - :edit_own_messages
  - :delete_messages
  - :delete_own_messages
  - :manage_boards
  - :view_calendar
  - :view_documents
  - :add_documents
  - :edit_documents
  - :delete_documents
  - :view_files
  - :manage_files
  - :view_gantt
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :manage_issue_relations
  - :set_issues_private
  - :set_own_issues_private
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :set_notes_private
  - :delete_issues
  - :view_issue_watchers
  - :add_issue_watchers
  - :delete_issue_watchers
  - :import_issues
  - :manage_categories
  - :view_news
  - :manage_news
  - :comment_news
  - :view_changesets
  - :browse_repository
  - :commit_access
  - :manage_related_issues
  - :manage_repository
  - :view_time_entries
  - :log_time
  - :edit_time_entries
  - :edit_own_time_entries
  - :manage_project_activities
  - :view_wiki_pages
  - :view_wiki_edits
  - :export_wiki_pages
  - :edit_wiki_pages
  - :rename_wiki_pages
  - :delete_wiki_pages
  - :delete_wiki_pages_attachments
  - :protect_wiki_pages
  - :manage_wiki

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Automation
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :save_queries
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :import_issues
  - :manage_categories

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


# user_preferences

others:
  ---
  :no_self_notified: '1'
  :my_page_layout:
    left: []
    right: []
  :my_page_settings: {}
  :gantt_zoom: 2
  :gantt_months: 6
  :comments_sorting: asc
  :warn_on_leaving_unsaved: '1'
  :textarea_font: ''


others:
  ---
  :no_self_notified: '1'
  :comments_sorting: asc
  :warn_on_leaving_unsaved: '1'
  :textarea_font: ''
  :my_page_layout:
    left:
    - issuesassignedtome
    right:
    - issuesreportedbyme
  :my_page_settings: {}


