diff --git a/.proto/redcarbon/agents_public/v1/types.proto b/.proto/redcarbon/agents_public/v1/types.proto
index d95da02..ae72e5a 100644
--- a/.proto/redcarbon/agents_public/v1/types.proto
+++ b/.proto/redcarbon/agents_public/v1/types.proto
@@ -2,6 +2,8 @@ syntax = "proto3";
 
 package redcarbon.agents_public.v1;
 
+import "google/protobuf/duration.proto";
+
 message AgentConfiguration {
   optional QRadarJobConfiguration qradar_job_configuration = 1;
   optional SentinelOneJobConfiguration sentinelone_job_configuration = 2;
@@ -26,3 +28,22 @@ message FortiSIEMJobConfiguration {
   string password = 3;
   bool verify_ssl = 4;
 }
+
+message ValueHeader {
+  repeated string values = 1;
+}
+
+message AgentRequest {
+  string request_id = 1;
+  string method = 2;
+  string url = 3;
+  map<string, ValueHeader> headers = 4;
+  bytes body = 5;
+  google.protobuf.Duration timeout = 6;
+}
+
+message AgentResponse {
+  int32 status = 1;
+  map<string, ValueHeader> headers = 2;
+  bytes body = 3;
+}
diff --git a/.proto/redcarbon/agents_public/v1/v1.proto b/.proto/redcarbon/agents_public/v1/v1.proto
index e76d548..7eecc11 100644
--- a/.proto/redcarbon/agents_public/v1/v1.proto
+++ b/.proto/redcarbon/agents_public/v1/v1.proto
@@ -9,6 +9,8 @@ service AgentsPublicAPIsV1Srv {
   rpc HZ(HZRequest) returns (HZResponse) {}
   rpc IngestIncident(IngestIncidentRequest) returns (IngestIncidentResponse) {}
   rpc FetchAgentConfiguration(FetchAgentConfigurationRequest) returns (FetchAgentConfigurationResponse) {}
+  rpc FetchAgentRequests(FetchAgentRequestsRequest) returns (FetchAgentRequestsResponse) {}
+  rpc SubmitAgentResponse(SubmitAgentResponseRequest) returns (SubmitAgentResponseResponse) {}
 }
 
 message HZRequest {
@@ -37,3 +39,16 @@ message FetchAgentConfigurationRequest {}
 message FetchAgentConfigurationResponse {
   AgentConfiguration configuration = 1;
 }
+
+message FetchAgentRequestsRequest {}
+
+message FetchAgentRequestsResponse {
+  repeated AgentRequest requests = 1;
+}
+
+message SubmitAgentResponseRequest {
+  string request_id = 1;
+  AgentResponse response = 2;
+}
+
+message SubmitAgentResponseResponse {}
\ No newline at end of file
diff --git a/cmd/main.go b/cmd/main.go
index f0a5565..ba3c540 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -3,17 +3,18 @@ package main
 import (
 	"context"
 	"errors"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
 	"github.com/go-co-op/gocron"
 	"github.com/google/go-github/v50/github"
 	"golang.org/x/sync/errgroup"
-	"os"
-	"os/signal"
 	"pkg.redcarbon.ai/cmd/profile"
 	"pkg.redcarbon.ai/internal/cli"
 	"pkg.redcarbon.ai/internal/config"
 	"pkg.redcarbon.ai/internal/routines"
-	"syscall"
-	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -27,6 +28,7 @@ const (
 	configRoutineInterval = "10m"
 	updateRoutineInterval = "1d"
 	debugRoutineInterval  = "2s"
+	proxyRoutineInterval  = "500ms"
 
 	updateErrorCode = 3
 )
@@ -79,9 +81,8 @@ func run(cmd *cobra.Command, args []string) {
 		logrus.Fatal("No profiles found, please add one by running `redcarbon profile add`")
 	}
 
-	ctx, cancelFn := signal.NotifyContext(context.Background(), syscall.SIGINT)
-
-	defer cancelFn()
+	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT)
+	defer cancel()
 
 	g, ctx := errgroup.WithContext(ctx)
 
@@ -101,6 +102,7 @@ func run(cmd *cobra.Command, args []string) {
 			s.Every(updateRoutineInterval).StartImmediately().SingletonMode().Do(r.UpdateRoutine, ctx)
 			s.Every(hzRoutineInterval).StartImmediately().Do(r.HZRoutine, ctx)
 			s.Every(configRoutine).StartImmediately().SingletonMode().Do(r.ConfigRoutine, ctx)
+			s.Every(proxyRoutineInterval).StartImmediately().Do(r.ProxyRoutine, ctx)
 
 			return nil
 		})
diff --git a/internal/routines/proxy.go b/internal/routines/proxy.go
new file mode 100644
index 0000000..47a0a92
--- /dev/null
+++ b/internal/routines/proxy.go
@@ -0,0 +1,184 @@
+package routines
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"connectrpc.com/connect"
+	"github.com/sirupsen/logrus"
+	"google.golang.org/protobuf/types/known/durationpb"
+	agents_publicv1 "pkg.redcarbon.ai/proto/redcarbon/agents_public/v1"
+)
+
+var defaultTimeout = 1 * time.Minute
+
+var httpCli = &http.Client{
+	Timeout: defaultTimeout,
+	Transport: &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	},
+}
+
+func (r RoutineConfig) ProxyRoutine(ctx context.Context) {
+	logrus.Debug("Starting the proxy routine...")
+
+	// Prepare the request to fetch agent requests
+	req := connect.NewRequest(&agents_publicv1.FetchAgentRequestsRequest{})
+	req.Header().Set("authorization", fmt.Sprintf("ApiToken %s", r.profile.Profile.Token))
+
+	ctx, cancel := context.WithTimeout(ctx, defaultTimeout)
+	defer cancel()
+
+	logrus.Debug("Fetching the agent requests...")
+	res, err := r.agentsCli.FetchAgentRequests(ctx, req)
+	if err != nil {
+		logrus.WithError(err).Error("Error while fetching the agent requests")
+		return
+	}
+
+	logrus.Debugf("Running %d agent requests...", len(res.Msg.Requests))
+
+	var wg sync.WaitGroup
+
+	for _, agentReq := range res.Msg.Requests {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			r.processRequest(ctx, agentReq)
+		}()
+	}
+
+	wg.Wait()
+
+	logrus.Debug("Proxy routine completed")
+}
+
+func (r RoutineConfig) processRequest(ctx context.Context, req *agents_publicv1.AgentRequest) {
+	l := logrus.WithFields(logrus.Fields{
+		"id": req.RequestId,
+	})
+
+	l.Debug("Handling request...")
+
+	ctx, cancel := extractTimeout(ctx, req.Timeout)
+	defer cancel()
+
+	httpReq, err := r.createHTTPProxyRequest(ctx, req)
+	if err != nil {
+		l.WithError(err).Error("Error while creating the HTTP request")
+		r.sendErrorToServer(ctx, req, "error while creating the HTTP request")
+		return
+	}
+
+	logrus.WithField("headers", httpReq.Header).Infof("Executing HTTP request: %s %s", req.Method, req.Url)
+
+	httpRes, err := httpCli.Do(httpReq)
+	if err != nil {
+		l.WithError(err).Error("Error while executing the HTTP request")
+		r.sendErrorToServer(ctx, req, "error while executing the HTTP request")
+		return
+	}
+	defer httpRes.Body.Close()
+
+	l.Infof("Request completed with status code %d, sending the response to the server", httpRes.StatusCode)
+
+	err = r.sendResponseToServer(ctx, req, httpRes)
+	if err != nil {
+		l.WithError(err).Error("Error while sending the response to the server")
+		r.sendErrorToServer(ctx, req, "error while sending the response to the server")
+		return
+	}
+}
+
+func extractTimeout(ctx context.Context, requestTimeout *durationpb.Duration) (context.Context, context.CancelFunc) {
+	timeout := 10 * time.Second
+	if requestTimeout != nil && requestTimeout.AsDuration() > 0 {
+		timeout = requestTimeout.AsDuration()
+	}
+
+	return context.WithTimeout(ctx, timeout)
+}
+
+func (r RoutineConfig) createHTTPProxyRequest(ctx context.Context, req *agents_publicv1.AgentRequest) (*http.Request, error) {
+	// Url is already validated by the server
+	httpReq, err := http.NewRequestWithContext(ctx, req.Method, req.Url, bytes.NewBuffer(req.Body))
+	if err != nil {
+		return nil, err
+	}
+
+	for key, value := range req.Headers {
+		if strings.ToLower(key) == "accept-encoding" {
+			continue
+		}
+
+		for _, v := range value.Values {
+			httpReq.Header.Add(key, v)
+		}
+	}
+
+	return httpReq, nil
+}
+
+func (r RoutineConfig) sendErrorToServer(ctx context.Context, req *agents_publicv1.AgentRequest, reason string) {
+	body, err := json.Marshal(map[string]string{
+		"error": reason,
+	})
+	if err != nil {
+		logrus.WithError(err).Error("Error while marshalling the error to the server")
+		return
+	}
+
+	response := connect.NewRequest(&agents_publicv1.SubmitAgentResponseRequest{
+		RequestId: req.RequestId,
+		Response: &agents_publicv1.AgentResponse{
+			Status:  int32(http.StatusInternalServerError),
+			Body:    body,
+			Headers: map[string]*agents_publicv1.ValueHeader{},
+		},
+	})
+	response.Header().Set("authorization", fmt.Sprintf("ApiToken %s", r.profile.Profile.Token))
+
+	_, err = r.agentsCli.SubmitAgentResponse(ctx, response)
+	if err != nil {
+		logrus.WithError(err).Error("Error while sending the error to the server")
+	}
+}
+
+func (r RoutineConfig) sendResponseToServer(ctx context.Context, req *agents_publicv1.AgentRequest, httpRes *http.Response) error {
+	body, err := io.ReadAll(httpRes.Body)
+	if err != nil {
+		return err
+	}
+
+	headers := make(map[string]*agents_publicv1.ValueHeader)
+	for key, values := range httpRes.Header {
+		headers[key] = &agents_publicv1.ValueHeader{
+			Values: values,
+		}
+	}
+
+	response := connect.NewRequest(&agents_publicv1.SubmitAgentResponseRequest{
+		RequestId: req.RequestId,
+		Response: &agents_publicv1.AgentResponse{
+			Status:  int32(httpRes.StatusCode),
+			Body:    body,
+			Headers: headers,
+		},
+	})
+	response.Header().Set("authorization", fmt.Sprintf("ApiToken %s", r.profile.Profile.Token))
+
+	_, err = r.agentsCli.SubmitAgentResponse(ctx, response)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..fc45e67
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,3 @@
+[tools]
+buf = "1.45.0"
+go = "1.24"
diff --git a/proto/redcarbon/agents_public/v1/agents_publicv1connect/v1.connect.go b/proto/redcarbon/agents_public/v1/agents_publicv1connect/v1.connect.go
index 2b75d35..6470c08 100644
--- a/proto/redcarbon/agents_public/v1/agents_publicv1connect/v1.connect.go
+++ b/proto/redcarbon/agents_public/v1/agents_publicv1connect/v1.connect.go
@@ -42,14 +42,12 @@ const (
 	// AgentsPublicAPIsV1SrvFetchAgentConfigurationProcedure is the fully-qualified name of the
 	// AgentsPublicAPIsV1Srv's FetchAgentConfiguration RPC.
 	AgentsPublicAPIsV1SrvFetchAgentConfigurationProcedure = "/redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv/FetchAgentConfiguration"
-)
-
-// These variables are the protoreflect.Descriptor objects for the RPCs defined in this package.
-var (
-	agentsPublicAPIsV1SrvServiceDescriptor                       = v1.File_redcarbon_agents_public_v1_v1_proto.Services().ByName("AgentsPublicAPIsV1Srv")
-	agentsPublicAPIsV1SrvHZMethodDescriptor                      = agentsPublicAPIsV1SrvServiceDescriptor.Methods().ByName("HZ")
-	agentsPublicAPIsV1SrvIngestIncidentMethodDescriptor          = agentsPublicAPIsV1SrvServiceDescriptor.Methods().ByName("IngestIncident")
-	agentsPublicAPIsV1SrvFetchAgentConfigurationMethodDescriptor = agentsPublicAPIsV1SrvServiceDescriptor.Methods().ByName("FetchAgentConfiguration")
+	// AgentsPublicAPIsV1SrvFetchAgentRequestsProcedure is the fully-qualified name of the
+	// AgentsPublicAPIsV1Srv's FetchAgentRequests RPC.
+	AgentsPublicAPIsV1SrvFetchAgentRequestsProcedure = "/redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv/FetchAgentRequests"
+	// AgentsPublicAPIsV1SrvSubmitAgentResponseProcedure is the fully-qualified name of the
+	// AgentsPublicAPIsV1Srv's SubmitAgentResponse RPC.
+	AgentsPublicAPIsV1SrvSubmitAgentResponseProcedure = "/redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv/SubmitAgentResponse"
 )
 
 // AgentsPublicAPIsV1SrvClient is a client for the redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv
@@ -58,6 +56,8 @@ type AgentsPublicAPIsV1SrvClient interface {
 	HZ(context.Context, *connect.Request[v1.HZRequest]) (*connect.Response[v1.HZResponse], error)
 	IngestIncident(context.Context, *connect.Request[v1.IngestIncidentRequest]) (*connect.Response[v1.IngestIncidentResponse], error)
 	FetchAgentConfiguration(context.Context, *connect.Request[v1.FetchAgentConfigurationRequest]) (*connect.Response[v1.FetchAgentConfigurationResponse], error)
+	FetchAgentRequests(context.Context, *connect.Request[v1.FetchAgentRequestsRequest]) (*connect.Response[v1.FetchAgentRequestsResponse], error)
+	SubmitAgentResponse(context.Context, *connect.Request[v1.SubmitAgentResponseRequest]) (*connect.Response[v1.SubmitAgentResponseResponse], error)
 }
 
 // NewAgentsPublicAPIsV1SrvClient constructs a client for the
@@ -70,23 +70,36 @@ type AgentsPublicAPIsV1SrvClient interface {
 // http://api.acme.com or https://acme.com/grpc).
 func NewAgentsPublicAPIsV1SrvClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AgentsPublicAPIsV1SrvClient {
 	baseURL = strings.TrimRight(baseURL, "/")
+	agentsPublicAPIsV1SrvMethods := v1.File_redcarbon_agents_public_v1_v1_proto.Services().ByName("AgentsPublicAPIsV1Srv").Methods()
 	return &agentsPublicAPIsV1SrvClient{
 		hZ: connect.NewClient[v1.HZRequest, v1.HZResponse](
 			httpClient,
 			baseURL+AgentsPublicAPIsV1SrvHZProcedure,
-			connect.WithSchema(agentsPublicAPIsV1SrvHZMethodDescriptor),
+			connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("HZ")),
 			connect.WithClientOptions(opts...),
 		),
 		ingestIncident: connect.NewClient[v1.IngestIncidentRequest, v1.IngestIncidentResponse](
 			httpClient,
 			baseURL+AgentsPublicAPIsV1SrvIngestIncidentProcedure,
-			connect.WithSchema(agentsPublicAPIsV1SrvIngestIncidentMethodDescriptor),
+			connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("IngestIncident")),
 			connect.WithClientOptions(opts...),
 		),
 		fetchAgentConfiguration: connect.NewClient[v1.FetchAgentConfigurationRequest, v1.FetchAgentConfigurationResponse](
 			httpClient,
 			baseURL+AgentsPublicAPIsV1SrvFetchAgentConfigurationProcedure,
-			connect.WithSchema(agentsPublicAPIsV1SrvFetchAgentConfigurationMethodDescriptor),
+			connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("FetchAgentConfiguration")),
+			connect.WithClientOptions(opts...),
+		),
+		fetchAgentRequests: connect.NewClient[v1.FetchAgentRequestsRequest, v1.FetchAgentRequestsResponse](
+			httpClient,
+			baseURL+AgentsPublicAPIsV1SrvFetchAgentRequestsProcedure,
+			connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("FetchAgentRequests")),
+			connect.WithClientOptions(opts...),
+		),
+		submitAgentResponse: connect.NewClient[v1.SubmitAgentResponseRequest, v1.SubmitAgentResponseResponse](
+			httpClient,
+			baseURL+AgentsPublicAPIsV1SrvSubmitAgentResponseProcedure,
+			connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("SubmitAgentResponse")),
 			connect.WithClientOptions(opts...),
 		),
 	}
@@ -97,6 +110,8 @@ type agentsPublicAPIsV1SrvClient struct {
 	hZ                      *connect.Client[v1.HZRequest, v1.HZResponse]
 	ingestIncident          *connect.Client[v1.IngestIncidentRequest, v1.IngestIncidentResponse]
 	fetchAgentConfiguration *connect.Client[v1.FetchAgentConfigurationRequest, v1.FetchAgentConfigurationResponse]
+	fetchAgentRequests      *connect.Client[v1.FetchAgentRequestsRequest, v1.FetchAgentRequestsResponse]
+	submitAgentResponse     *connect.Client[v1.SubmitAgentResponseRequest, v1.SubmitAgentResponseResponse]
 }
 
 // HZ calls redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.HZ.
@@ -115,12 +130,24 @@ func (c *agentsPublicAPIsV1SrvClient) FetchAgentConfiguration(ctx context.Contex
 	return c.fetchAgentConfiguration.CallUnary(ctx, req)
 }
 
+// FetchAgentRequests calls redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentRequests.
+func (c *agentsPublicAPIsV1SrvClient) FetchAgentRequests(ctx context.Context, req *connect.Request[v1.FetchAgentRequestsRequest]) (*connect.Response[v1.FetchAgentRequestsResponse], error) {
+	return c.fetchAgentRequests.CallUnary(ctx, req)
+}
+
+// SubmitAgentResponse calls redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.SubmitAgentResponse.
+func (c *agentsPublicAPIsV1SrvClient) SubmitAgentResponse(ctx context.Context, req *connect.Request[v1.SubmitAgentResponseRequest]) (*connect.Response[v1.SubmitAgentResponseResponse], error) {
+	return c.submitAgentResponse.CallUnary(ctx, req)
+}
+
 // AgentsPublicAPIsV1SrvHandler is an implementation of the
 // redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv service.
 type AgentsPublicAPIsV1SrvHandler interface {
 	HZ(context.Context, *connect.Request[v1.HZRequest]) (*connect.Response[v1.HZResponse], error)
 	IngestIncident(context.Context, *connect.Request[v1.IngestIncidentRequest]) (*connect.Response[v1.IngestIncidentResponse], error)
 	FetchAgentConfiguration(context.Context, *connect.Request[v1.FetchAgentConfigurationRequest]) (*connect.Response[v1.FetchAgentConfigurationResponse], error)
+	FetchAgentRequests(context.Context, *connect.Request[v1.FetchAgentRequestsRequest]) (*connect.Response[v1.FetchAgentRequestsResponse], error)
+	SubmitAgentResponse(context.Context, *connect.Request[v1.SubmitAgentResponseRequest]) (*connect.Response[v1.SubmitAgentResponseResponse], error)
 }
 
 // NewAgentsPublicAPIsV1SrvHandler builds an HTTP handler from the service implementation. It
@@ -129,22 +156,35 @@ type AgentsPublicAPIsV1SrvHandler interface {
 // By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
 // and JSON codecs. They also support gzip compression.
 func NewAgentsPublicAPIsV1SrvHandler(svc AgentsPublicAPIsV1SrvHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	agentsPublicAPIsV1SrvMethods := v1.File_redcarbon_agents_public_v1_v1_proto.Services().ByName("AgentsPublicAPIsV1Srv").Methods()
 	agentsPublicAPIsV1SrvHZHandler := connect.NewUnaryHandler(
 		AgentsPublicAPIsV1SrvHZProcedure,
 		svc.HZ,
-		connect.WithSchema(agentsPublicAPIsV1SrvHZMethodDescriptor),
+		connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("HZ")),
 		connect.WithHandlerOptions(opts...),
 	)
 	agentsPublicAPIsV1SrvIngestIncidentHandler := connect.NewUnaryHandler(
 		AgentsPublicAPIsV1SrvIngestIncidentProcedure,
 		svc.IngestIncident,
-		connect.WithSchema(agentsPublicAPIsV1SrvIngestIncidentMethodDescriptor),
+		connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("IngestIncident")),
 		connect.WithHandlerOptions(opts...),
 	)
 	agentsPublicAPIsV1SrvFetchAgentConfigurationHandler := connect.NewUnaryHandler(
 		AgentsPublicAPIsV1SrvFetchAgentConfigurationProcedure,
 		svc.FetchAgentConfiguration,
-		connect.WithSchema(agentsPublicAPIsV1SrvFetchAgentConfigurationMethodDescriptor),
+		connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("FetchAgentConfiguration")),
+		connect.WithHandlerOptions(opts...),
+	)
+	agentsPublicAPIsV1SrvFetchAgentRequestsHandler := connect.NewUnaryHandler(
+		AgentsPublicAPIsV1SrvFetchAgentRequestsProcedure,
+		svc.FetchAgentRequests,
+		connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("FetchAgentRequests")),
+		connect.WithHandlerOptions(opts...),
+	)
+	agentsPublicAPIsV1SrvSubmitAgentResponseHandler := connect.NewUnaryHandler(
+		AgentsPublicAPIsV1SrvSubmitAgentResponseProcedure,
+		svc.SubmitAgentResponse,
+		connect.WithSchema(agentsPublicAPIsV1SrvMethods.ByName("SubmitAgentResponse")),
 		connect.WithHandlerOptions(opts...),
 	)
 	return "/redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -155,6 +195,10 @@ func NewAgentsPublicAPIsV1SrvHandler(svc AgentsPublicAPIsV1SrvHandler, opts ...c
 			agentsPublicAPIsV1SrvIngestIncidentHandler.ServeHTTP(w, r)
 		case AgentsPublicAPIsV1SrvFetchAgentConfigurationProcedure:
 			agentsPublicAPIsV1SrvFetchAgentConfigurationHandler.ServeHTTP(w, r)
+		case AgentsPublicAPIsV1SrvFetchAgentRequestsProcedure:
+			agentsPublicAPIsV1SrvFetchAgentRequestsHandler.ServeHTTP(w, r)
+		case AgentsPublicAPIsV1SrvSubmitAgentResponseProcedure:
+			agentsPublicAPIsV1SrvSubmitAgentResponseHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -175,3 +219,11 @@ func (UnimplementedAgentsPublicAPIsV1SrvHandler) IngestIncident(context.Context,
 func (UnimplementedAgentsPublicAPIsV1SrvHandler) FetchAgentConfiguration(context.Context, *connect.Request[v1.FetchAgentConfigurationRequest]) (*connect.Response[v1.FetchAgentConfigurationResponse], error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentConfiguration is not implemented"))
 }
+
+func (UnimplementedAgentsPublicAPIsV1SrvHandler) FetchAgentRequests(context.Context, *connect.Request[v1.FetchAgentRequestsRequest]) (*connect.Response[v1.FetchAgentRequestsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentRequests is not implemented"))
+}
+
+func (UnimplementedAgentsPublicAPIsV1SrvHandler) SubmitAgentResponse(context.Context, *connect.Request[v1.SubmitAgentResponseRequest]) (*connect.Response[v1.SubmitAgentResponseResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.SubmitAgentResponse is not implemented"))
+}
diff --git a/proto/redcarbon/agents_public/v1/types.pb.go b/proto/redcarbon/agents_public/v1/types.pb.go
index 9d42a45..8200dbf 100644
--- a/proto/redcarbon/agents_public/v1/types.pb.go
+++ b/proto/redcarbon/agents_public/v1/types.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.34.2
+// 	protoc-gen-go v1.36.6
 // 	protoc        (unknown)
 // source: redcarbon/agents_public/v1/types.proto
 
@@ -9,8 +9,10 @@ package agents_publicv1
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -21,22 +23,19 @@ const (
 )
 
 type AgentConfiguration struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state                       protoimpl.MessageState       `protogen:"open.v1"`
 	QradarJobConfiguration      *QRadarJobConfiguration      `protobuf:"bytes,1,opt,name=qradar_job_configuration,json=qradarJobConfiguration,proto3,oneof" json:"qradar_job_configuration,omitempty"`
 	SentineloneJobConfiguration *SentinelOneJobConfiguration `protobuf:"bytes,2,opt,name=sentinelone_job_configuration,json=sentineloneJobConfiguration,proto3,oneof" json:"sentinelone_job_configuration,omitempty"`
 	FortisiemJobConfiguration   *FortiSIEMJobConfiguration   `protobuf:"bytes,3,opt,name=fortisiem_job_configuration,json=fortisiemJobConfiguration,proto3,oneof" json:"fortisiem_job_configuration,omitempty"`
+	unknownFields               protoimpl.UnknownFields
+	sizeCache                   protoimpl.SizeCache
 }
 
 func (x *AgentConfiguration) Reset() {
 	*x = AgentConfiguration{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *AgentConfiguration) String() string {
@@ -47,7 +46,7 @@ func (*AgentConfiguration) ProtoMessage() {}
 
 func (x *AgentConfiguration) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -84,22 +83,19 @@ func (x *AgentConfiguration) GetFortisiemJobConfiguration() *FortiSIEMJobConfigu
 }
 
 type QRadarJobConfiguration struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Token         string                 `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
+	VerifySsl     bool                   `protobuf:"varint,3,opt,name=verify_ssl,json=verifySsl,proto3" json:"verify_ssl,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Host      string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
-	Token     string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
-	VerifySsl bool   `protobuf:"varint,3,opt,name=verify_ssl,json=verifySsl,proto3" json:"verify_ssl,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *QRadarJobConfiguration) Reset() {
 	*x = QRadarJobConfiguration{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *QRadarJobConfiguration) String() string {
@@ -110,7 +106,7 @@ func (*QRadarJobConfiguration) ProtoMessage() {}
 
 func (x *QRadarJobConfiguration) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -147,22 +143,19 @@ func (x *QRadarJobConfiguration) GetVerifySsl() bool {
 }
 
 type SentinelOneJobConfiguration struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Token         string                 `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
+	VerifySsl     bool                   `protobuf:"varint,3,opt,name=verify_ssl,json=verifySsl,proto3" json:"verify_ssl,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Host      string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
-	Token     string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
-	VerifySsl bool   `protobuf:"varint,3,opt,name=verify_ssl,json=verifySsl,proto3" json:"verify_ssl,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SentinelOneJobConfiguration) Reset() {
 	*x = SentinelOneJobConfiguration{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SentinelOneJobConfiguration) String() string {
@@ -173,7 +166,7 @@ func (*SentinelOneJobConfiguration) ProtoMessage() {}
 
 func (x *SentinelOneJobConfiguration) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -210,23 +203,20 @@ func (x *SentinelOneJobConfiguration) GetVerifySsl() bool {
 }
 
 type FortiSIEMJobConfiguration struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Username      string                 `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
+	Password      string                 `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
+	VerifySsl     bool                   `protobuf:"varint,4,opt,name=verify_ssl,json=verifySsl,proto3" json:"verify_ssl,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Host      string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
-	Username  string `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
-	Password  string `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
-	VerifySsl bool   `protobuf:"varint,4,opt,name=verify_ssl,json=verifySsl,proto3" json:"verify_ssl,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *FortiSIEMJobConfiguration) Reset() {
 	*x = FortiSIEMJobConfiguration{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *FortiSIEMJobConfiguration) String() string {
@@ -237,7 +227,7 @@ func (*FortiSIEMJobConfiguration) ProtoMessage() {}
 
 func (x *FortiSIEMJobConfiguration) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -280,111 +270,284 @@ func (x *FortiSIEMJobConfiguration) GetVerifySsl() bool {
 	return false
 }
 
-var File_redcarbon_agents_public_v1_types_proto protoreflect.FileDescriptor
+type ValueHeader struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Values        []string               `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ValueHeader) Reset() {
+	*x = ValueHeader{}
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ValueHeader) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ValueHeader) ProtoMessage() {}
+
+func (x *ValueHeader) ProtoReflect() protoreflect.Message {
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ValueHeader.ProtoReflect.Descriptor instead.
+func (*ValueHeader) Descriptor() ([]byte, []int) {
+	return file_redcarbon_agents_public_v1_types_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ValueHeader) GetValues() []string {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
+type AgentRequest struct {
+	state         protoimpl.MessageState  `protogen:"open.v1"`
+	RequestId     string                  `protobuf:"bytes,1,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
+	Method        string                  `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
+	Url           string                  `protobuf:"bytes,3,opt,name=url,proto3" json:"url,omitempty"`
+	Headers       map[string]*ValueHeader `protobuf:"bytes,4,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	Body          []byte                  `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
+	Timeout       *durationpb.Duration    `protobuf:"bytes,6,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AgentRequest) Reset() {
+	*x = AgentRequest{}
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AgentRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AgentRequest) ProtoMessage() {}
+
+func (x *AgentRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
 
-var file_redcarbon_agents_public_v1_types_proto_rawDesc = []byte{
-	0x0a, 0x26, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2f, 0x61, 0x67, 0x65, 0x6e,
-	0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x79, 0x70,
-	0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1a, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72,
-	0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x2e, 0x76, 0x31, 0x22, 0xe5, 0x03, 0x0a, 0x12, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x71, 0x0a, 0x18, 0x71,
-	0x72, 0x61, 0x64, 0x61, 0x72, 0x5f, 0x6a, 0x6f, 0x62, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e,
-	0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73,
-	0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2e, 0x76, 0x31, 0x2e, 0x51, 0x52, 0x61, 0x64, 0x61,
-	0x72, 0x4a, 0x6f, 0x62, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x48, 0x00, 0x52, 0x16, 0x71, 0x72, 0x61, 0x64, 0x61, 0x72, 0x4a, 0x6f, 0x62, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x80,
-	0x01, 0x0a, 0x1d, 0x73, 0x65, 0x6e, 0x74, 0x69, 0x6e, 0x65, 0x6c, 0x6f, 0x6e, 0x65, 0x5f, 0x6a,
-	0x6f, 0x62, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x37, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62,
-	0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x74, 0x69, 0x6e, 0x65, 0x6c, 0x4f, 0x6e, 0x65, 0x4a,
-	0x6f, 0x62, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48,
-	0x01, 0x52, 0x1b, 0x73, 0x65, 0x6e, 0x74, 0x69, 0x6e, 0x65, 0x6c, 0x6f, 0x6e, 0x65, 0x4a, 0x6f,
-	0x62, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01,
-	0x01, 0x12, 0x7a, 0x0a, 0x1b, 0x66, 0x6f, 0x72, 0x74, 0x69, 0x73, 0x69, 0x65, 0x6d, 0x5f, 0x6a,
-	0x6f, 0x62, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62,
-	0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x2e, 0x76, 0x31, 0x2e, 0x46, 0x6f, 0x72, 0x74, 0x69, 0x53, 0x49, 0x45, 0x4d, 0x4a, 0x6f, 0x62,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x02, 0x52,
-	0x19, 0x66, 0x6f, 0x72, 0x74, 0x69, 0x73, 0x69, 0x65, 0x6d, 0x4a, 0x6f, 0x62, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x1b, 0x0a,
-	0x19, 0x5f, 0x71, 0x72, 0x61, 0x64, 0x61, 0x72, 0x5f, 0x6a, 0x6f, 0x62, 0x5f, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x20, 0x0a, 0x1e, 0x5f, 0x73,
-	0x65, 0x6e, 0x74, 0x69, 0x6e, 0x65, 0x6c, 0x6f, 0x6e, 0x65, 0x5f, 0x6a, 0x6f, 0x62, 0x5f, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x1e, 0x0a, 0x1c,
-	0x5f, 0x66, 0x6f, 0x72, 0x74, 0x69, 0x73, 0x69, 0x65, 0x6d, 0x5f, 0x6a, 0x6f, 0x62, 0x5f, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x61, 0x0a, 0x16,
-	0x51, 0x52, 0x61, 0x64, 0x61, 0x72, 0x4a, 0x6f, 0x62, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f,
-	0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
-	0x12, 0x1d, 0x0a, 0x0a, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x5f, 0x73, 0x73, 0x6c, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x53, 0x73, 0x6c, 0x22,
-	0x66, 0x0a, 0x1b, 0x53, 0x65, 0x6e, 0x74, 0x69, 0x6e, 0x65, 0x6c, 0x4f, 0x6e, 0x65, 0x4a, 0x6f,
-	0x62, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12,
-	0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f,
-	0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x76, 0x65, 0x72, 0x69,
-	0x66, 0x79, 0x5f, 0x73, 0x73, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x76, 0x65,
-	0x72, 0x69, 0x66, 0x79, 0x53, 0x73, 0x6c, 0x22, 0x86, 0x01, 0x0a, 0x19, 0x46, 0x6f, 0x72, 0x74,
-	0x69, 0x53, 0x49, 0x45, 0x4d, 0x4a, 0x6f, 0x62, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65,
-	0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65,
-	0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x5f, 0x73, 0x73, 0x6c, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x53, 0x73, 0x6c,
-	0x42, 0xf5, 0x01, 0x0a, 0x1e, 0x63, 0x6f, 0x6d, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62,
-	0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x2e, 0x76, 0x31, 0x42, 0x0a, 0x54, 0x79, 0x70, 0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
-	0x01, 0x5a, 0x41, 0x70, 0x6b, 0x67, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e,
-	0x2e, 0x61, 0x69, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72,
-	0x62, 0x6f, 0x6e, 0x2f, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x2f, 0x76, 0x31, 0x3b, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x52, 0x41, 0x58, 0xaa, 0x02, 0x19, 0x52, 0x65, 0x64,
-	0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x19, 0x52, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62,
-	0x6f, 0x6e, 0x5c, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5c,
-	0x56, 0x31, 0xe2, 0x02, 0x25, 0x52, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x5c, 0x41,
-	0x67, 0x65, 0x6e, 0x74, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5c, 0x56, 0x31, 0x5c, 0x47,
-	0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1b, 0x52, 0x65, 0x64,
-	0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x3a, 0x3a, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+// Deprecated: Use AgentRequest.ProtoReflect.Descriptor instead.
+func (*AgentRequest) Descriptor() ([]byte, []int) {
+	return file_redcarbon_agents_public_v1_types_proto_rawDescGZIP(), []int{5}
 }
 
+func (x *AgentRequest) GetRequestId() string {
+	if x != nil {
+		return x.RequestId
+	}
+	return ""
+}
+
+func (x *AgentRequest) GetMethod() string {
+	if x != nil {
+		return x.Method
+	}
+	return ""
+}
+
+func (x *AgentRequest) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *AgentRequest) GetHeaders() map[string]*ValueHeader {
+	if x != nil {
+		return x.Headers
+	}
+	return nil
+}
+
+func (x *AgentRequest) GetBody() []byte {
+	if x != nil {
+		return x.Body
+	}
+	return nil
+}
+
+func (x *AgentRequest) GetTimeout() *durationpb.Duration {
+	if x != nil {
+		return x.Timeout
+	}
+	return nil
+}
+
+type AgentResponse struct {
+	state         protoimpl.MessageState  `protogen:"open.v1"`
+	Status        int32                   `protobuf:"varint,1,opt,name=status,proto3" json:"status,omitempty"`
+	Headers       map[string]*ValueHeader `protobuf:"bytes,2,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	Body          []byte                  `protobuf:"bytes,3,opt,name=body,proto3" json:"body,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AgentResponse) Reset() {
+	*x = AgentResponse{}
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AgentResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AgentResponse) ProtoMessage() {}
+
+func (x *AgentResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_redcarbon_agents_public_v1_types_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AgentResponse.ProtoReflect.Descriptor instead.
+func (*AgentResponse) Descriptor() ([]byte, []int) {
+	return file_redcarbon_agents_public_v1_types_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *AgentResponse) GetStatus() int32 {
+	if x != nil {
+		return x.Status
+	}
+	return 0
+}
+
+func (x *AgentResponse) GetHeaders() map[string]*ValueHeader {
+	if x != nil {
+		return x.Headers
+	}
+	return nil
+}
+
+func (x *AgentResponse) GetBody() []byte {
+	if x != nil {
+		return x.Body
+	}
+	return nil
+}
+
+var File_redcarbon_agents_public_v1_types_proto protoreflect.FileDescriptor
+
+const file_redcarbon_agents_public_v1_types_proto_rawDesc = "" +
+	"\n" +
+	"&redcarbon/agents_public/v1/types.proto\x12\x1aredcarbon.agents_public.v1\x1a\x1egoogle/protobuf/duration.proto\"\xe5\x03\n" +
+	"\x12AgentConfiguration\x12q\n" +
+	"\x18qradar_job_configuration\x18\x01 \x01(\v22.redcarbon.agents_public.v1.QRadarJobConfigurationH\x00R\x16qradarJobConfiguration\x88\x01\x01\x12\x80\x01\n" +
+	"\x1dsentinelone_job_configuration\x18\x02 \x01(\v27.redcarbon.agents_public.v1.SentinelOneJobConfigurationH\x01R\x1bsentineloneJobConfiguration\x88\x01\x01\x12z\n" +
+	"\x1bfortisiem_job_configuration\x18\x03 \x01(\v25.redcarbon.agents_public.v1.FortiSIEMJobConfigurationH\x02R\x19fortisiemJobConfiguration\x88\x01\x01B\x1b\n" +
+	"\x19_qradar_job_configurationB \n" +
+	"\x1e_sentinelone_job_configurationB\x1e\n" +
+	"\x1c_fortisiem_job_configuration\"a\n" +
+	"\x16QRadarJobConfiguration\x12\x12\n" +
+	"\x04host\x18\x01 \x01(\tR\x04host\x12\x14\n" +
+	"\x05token\x18\x02 \x01(\tR\x05token\x12\x1d\n" +
+	"\n" +
+	"verify_ssl\x18\x03 \x01(\bR\tverifySsl\"f\n" +
+	"\x1bSentinelOneJobConfiguration\x12\x12\n" +
+	"\x04host\x18\x01 \x01(\tR\x04host\x12\x14\n" +
+	"\x05token\x18\x02 \x01(\tR\x05token\x12\x1d\n" +
+	"\n" +
+	"verify_ssl\x18\x03 \x01(\bR\tverifySsl\"\x86\x01\n" +
+	"\x19FortiSIEMJobConfiguration\x12\x12\n" +
+	"\x04host\x18\x01 \x01(\tR\x04host\x12\x1a\n" +
+	"\busername\x18\x02 \x01(\tR\busername\x12\x1a\n" +
+	"\bpassword\x18\x03 \x01(\tR\bpassword\x12\x1d\n" +
+	"\n" +
+	"verify_ssl\x18\x04 \x01(\bR\tverifySsl\"%\n" +
+	"\vValueHeader\x12\x16\n" +
+	"\x06values\x18\x01 \x03(\tR\x06values\"\xd6\x02\n" +
+	"\fAgentRequest\x12\x1d\n" +
+	"\n" +
+	"request_id\x18\x01 \x01(\tR\trequestId\x12\x16\n" +
+	"\x06method\x18\x02 \x01(\tR\x06method\x12\x10\n" +
+	"\x03url\x18\x03 \x01(\tR\x03url\x12O\n" +
+	"\aheaders\x18\x04 \x03(\v25.redcarbon.agents_public.v1.AgentRequest.HeadersEntryR\aheaders\x12\x12\n" +
+	"\x04body\x18\x05 \x01(\fR\x04body\x123\n" +
+	"\atimeout\x18\x06 \x01(\v2\x19.google.protobuf.DurationR\atimeout\x1ac\n" +
+	"\fHeadersEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12=\n" +
+	"\x05value\x18\x02 \x01(\v2'.redcarbon.agents_public.v1.ValueHeaderR\x05value:\x028\x01\"\xf2\x01\n" +
+	"\rAgentResponse\x12\x16\n" +
+	"\x06status\x18\x01 \x01(\x05R\x06status\x12P\n" +
+	"\aheaders\x18\x02 \x03(\v26.redcarbon.agents_public.v1.AgentResponse.HeadersEntryR\aheaders\x12\x12\n" +
+	"\x04body\x18\x03 \x01(\fR\x04body\x1ac\n" +
+	"\fHeadersEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12=\n" +
+	"\x05value\x18\x02 \x01(\v2'.redcarbon.agents_public.v1.ValueHeaderR\x05value:\x028\x01B\xf5\x01\n" +
+	"\x1ecom.redcarbon.agents_public.v1B\n" +
+	"TypesProtoP\x01ZApkg.redcarbon.ai/proto/redcarbon/agents_public/v1;agents_publicv1\xa2\x02\x03RAX\xaa\x02\x19Redcarbon.AgentsPublic.V1\xca\x02\x19Redcarbon\\AgentsPublic\\V1\xe2\x02%Redcarbon\\AgentsPublic\\V1\\GPBMetadata\xea\x02\x1bRedcarbon::AgentsPublic::V1b\x06proto3"
+
 var (
 	file_redcarbon_agents_public_v1_types_proto_rawDescOnce sync.Once
-	file_redcarbon_agents_public_v1_types_proto_rawDescData = file_redcarbon_agents_public_v1_types_proto_rawDesc
+	file_redcarbon_agents_public_v1_types_proto_rawDescData []byte
 )
 
 func file_redcarbon_agents_public_v1_types_proto_rawDescGZIP() []byte {
 	file_redcarbon_agents_public_v1_types_proto_rawDescOnce.Do(func() {
-		file_redcarbon_agents_public_v1_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_redcarbon_agents_public_v1_types_proto_rawDescData)
+		file_redcarbon_agents_public_v1_types_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_redcarbon_agents_public_v1_types_proto_rawDesc), len(file_redcarbon_agents_public_v1_types_proto_rawDesc)))
 	})
 	return file_redcarbon_agents_public_v1_types_proto_rawDescData
 }
 
-var file_redcarbon_agents_public_v1_types_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_redcarbon_agents_public_v1_types_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
 var file_redcarbon_agents_public_v1_types_proto_goTypes = []any{
 	(*AgentConfiguration)(nil),          // 0: redcarbon.agents_public.v1.AgentConfiguration
 	(*QRadarJobConfiguration)(nil),      // 1: redcarbon.agents_public.v1.QRadarJobConfiguration
 	(*SentinelOneJobConfiguration)(nil), // 2: redcarbon.agents_public.v1.SentinelOneJobConfiguration
 	(*FortiSIEMJobConfiguration)(nil),   // 3: redcarbon.agents_public.v1.FortiSIEMJobConfiguration
+	(*ValueHeader)(nil),                 // 4: redcarbon.agents_public.v1.ValueHeader
+	(*AgentRequest)(nil),                // 5: redcarbon.agents_public.v1.AgentRequest
+	(*AgentResponse)(nil),               // 6: redcarbon.agents_public.v1.AgentResponse
+	nil,                                 // 7: redcarbon.agents_public.v1.AgentRequest.HeadersEntry
+	nil,                                 // 8: redcarbon.agents_public.v1.AgentResponse.HeadersEntry
+	(*durationpb.Duration)(nil),         // 9: google.protobuf.Duration
 }
 var file_redcarbon_agents_public_v1_types_proto_depIdxs = []int32{
 	1, // 0: redcarbon.agents_public.v1.AgentConfiguration.qradar_job_configuration:type_name -> redcarbon.agents_public.v1.QRadarJobConfiguration
 	2, // 1: redcarbon.agents_public.v1.AgentConfiguration.sentinelone_job_configuration:type_name -> redcarbon.agents_public.v1.SentinelOneJobConfiguration
 	3, // 2: redcarbon.agents_public.v1.AgentConfiguration.fortisiem_job_configuration:type_name -> redcarbon.agents_public.v1.FortiSIEMJobConfiguration
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
+	7, // 3: redcarbon.agents_public.v1.AgentRequest.headers:type_name -> redcarbon.agents_public.v1.AgentRequest.HeadersEntry
+	9, // 4: redcarbon.agents_public.v1.AgentRequest.timeout:type_name -> google.protobuf.Duration
+	8, // 5: redcarbon.agents_public.v1.AgentResponse.headers:type_name -> redcarbon.agents_public.v1.AgentResponse.HeadersEntry
+	4, // 6: redcarbon.agents_public.v1.AgentRequest.HeadersEntry.value:type_name -> redcarbon.agents_public.v1.ValueHeader
+	4, // 7: redcarbon.agents_public.v1.AgentResponse.HeadersEntry.value:type_name -> redcarbon.agents_public.v1.ValueHeader
+	8, // [8:8] is the sub-list for method output_type
+	8, // [8:8] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
 }
 
 func init() { file_redcarbon_agents_public_v1_types_proto_init() }
@@ -392,64 +555,14 @@ func file_redcarbon_agents_public_v1_types_proto_init() {
 	if File_redcarbon_agents_public_v1_types_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_redcarbon_agents_public_v1_types_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*AgentConfiguration); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_types_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*QRadarJobConfiguration); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_types_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*SentinelOneJobConfiguration); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_types_proto_msgTypes[3].Exporter = func(v any, i int) any {
-			switch v := v.(*FortiSIEMJobConfiguration); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	file_redcarbon_agents_public_v1_types_proto_msgTypes[0].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_redcarbon_agents_public_v1_types_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_redcarbon_agents_public_v1_types_proto_rawDesc), len(file_redcarbon_agents_public_v1_types_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   4,
+			NumMessages:   9,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -458,7 +571,6 @@ func file_redcarbon_agents_public_v1_types_proto_init() {
 		MessageInfos:      file_redcarbon_agents_public_v1_types_proto_msgTypes,
 	}.Build()
 	File_redcarbon_agents_public_v1_types_proto = out.File
-	file_redcarbon_agents_public_v1_types_proto_rawDesc = nil
 	file_redcarbon_agents_public_v1_types_proto_goTypes = nil
 	file_redcarbon_agents_public_v1_types_proto_depIdxs = nil
 }
diff --git a/proto/redcarbon/agents_public/v1/v1.pb.go b/proto/redcarbon/agents_public/v1/v1.pb.go
index 98f3549..46933ad 100644
--- a/proto/redcarbon/agents_public/v1/v1.pb.go
+++ b/proto/redcarbon/agents_public/v1/v1.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.34.2
+// 	protoc-gen-go v1.36.6
 // 	protoc        (unknown)
 // source: redcarbon/agents_public/v1/v1.proto
 
@@ -12,6 +12,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -22,21 +23,18 @@ const (
 )
 
 type HZRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Hostname      string                 `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	Ip            string                 `protobuf:"bytes,2,opt,name=ip,proto3" json:"ip,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
-	Ip       string `protobuf:"bytes,2,opt,name=ip,proto3" json:"ip,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HZRequest) Reset() {
 	*x = HZRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HZRequest) String() string {
@@ -47,7 +45,7 @@ func (*HZRequest) ProtoMessage() {}
 
 func (x *HZRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -77,20 +75,17 @@ func (x *HZRequest) GetIp() string {
 }
 
 type HZResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ReceivedAt    *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=received_at,json=receivedAt,proto3" json:"received_at,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	ReceivedAt *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=received_at,json=receivedAt,proto3" json:"received_at,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HZResponse) Reset() {
 	*x = HZResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HZResponse) String() string {
@@ -101,7 +96,7 @@ func (*HZResponse) ProtoMessage() {}
 
 func (x *HZResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -124,26 +119,23 @@ func (x *HZResponse) GetReceivedAt() *timestamppb.Timestamp {
 }
 
 type IngestIncidentRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Title         string                 `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
+	Description   string                 `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+	RawData       string                 `protobuf:"bytes,3,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"`
+	Severity      uint32                 `protobuf:"varint,4,opt,name=severity,proto3" json:"severity,omitempty"`
+	Origin        string                 `protobuf:"bytes,5,opt,name=origin,proto3" json:"origin,omitempty"`
+	OriginalId    *string                `protobuf:"bytes,6,opt,name=original_id,json=originalId,proto3,oneof" json:"original_id,omitempty"`
+	OriginalUrl   *string                `protobuf:"bytes,7,opt,name=original_url,json=originalUrl,proto3,oneof" json:"original_url,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Title       string  `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
-	Description string  `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
-	RawData     string  `protobuf:"bytes,3,opt,name=raw_data,json=rawData,proto3" json:"raw_data,omitempty"`
-	Severity    uint32  `protobuf:"varint,4,opt,name=severity,proto3" json:"severity,omitempty"`
-	Origin      string  `protobuf:"bytes,5,opt,name=origin,proto3" json:"origin,omitempty"`
-	OriginalId  *string `protobuf:"bytes,6,opt,name=original_id,json=originalId,proto3,oneof" json:"original_id,omitempty"`
-	OriginalUrl *string `protobuf:"bytes,7,opt,name=original_url,json=originalUrl,proto3,oneof" json:"original_url,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *IngestIncidentRequest) Reset() {
 	*x = IngestIncidentRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *IngestIncidentRequest) String() string {
@@ -154,7 +146,7 @@ func (*IngestIncidentRequest) ProtoMessage() {}
 
 func (x *IngestIncidentRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -219,18 +211,16 @@ func (x *IngestIncidentRequest) GetOriginalUrl() string {
 }
 
 type IngestIncidentResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *IngestIncidentResponse) Reset() {
 	*x = IngestIncidentResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *IngestIncidentResponse) String() string {
@@ -241,7 +231,7 @@ func (*IngestIncidentResponse) ProtoMessage() {}
 
 func (x *IngestIncidentResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -257,18 +247,16 @@ func (*IngestIncidentResponse) Descriptor() ([]byte, []int) {
 }
 
 type FetchAgentConfigurationRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *FetchAgentConfigurationRequest) Reset() {
 	*x = FetchAgentConfigurationRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *FetchAgentConfigurationRequest) String() string {
@@ -279,7 +267,7 @@ func (*FetchAgentConfigurationRequest) ProtoMessage() {}
 
 func (x *FetchAgentConfigurationRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -295,20 +283,17 @@ func (*FetchAgentConfigurationRequest) Descriptor() ([]byte, []int) {
 }
 
 type FetchAgentConfigurationResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Configuration *AgentConfiguration    `protobuf:"bytes,1,opt,name=configuration,proto3" json:"configuration,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Configuration *AgentConfiguration `protobuf:"bytes,1,opt,name=configuration,proto3" json:"configuration,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *FetchAgentConfigurationResponse) Reset() {
 	*x = FetchAgentConfigurationResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *FetchAgentConfigurationResponse) String() string {
@@ -319,7 +304,7 @@ func (*FetchAgentConfigurationResponse) ProtoMessage() {}
 
 func (x *FetchAgentConfigurationResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -341,110 +326,230 @@ func (x *FetchAgentConfigurationResponse) GetConfiguration() *AgentConfiguration
 	return nil
 }
 
-var File_redcarbon_agents_public_v1_v1_proto protoreflect.FileDescriptor
+type FetchAgentRequestsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *FetchAgentRequestsRequest) Reset() {
+	*x = FetchAgentRequestsRequest{}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *FetchAgentRequestsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FetchAgentRequestsRequest) ProtoMessage() {}
+
+func (x *FetchAgentRequestsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FetchAgentRequestsRequest.ProtoReflect.Descriptor instead.
+func (*FetchAgentRequestsRequest) Descriptor() ([]byte, []int) {
+	return file_redcarbon_agents_public_v1_v1_proto_rawDescGZIP(), []int{6}
+}
 
-var file_redcarbon_agents_public_v1_v1_proto_rawDesc = []byte{
-	0x0a, 0x23, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2f, 0x61, 0x67, 0x65, 0x6e,
-	0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x76, 0x31, 0x2f, 0x76, 0x31, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1a, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e,
-	0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2e, 0x76,
-	0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x26, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2f, 0x61, 0x67,
-	0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x76, 0x31, 0x2f, 0x74,
-	0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x37, 0x0a, 0x09, 0x48, 0x5a,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x70, 0x22, 0x49, 0x0a, 0x0a, 0x48, 0x5a, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x3b, 0x0a, 0x0b, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x74,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x0a, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x41, 0x74, 0x22, 0x8d,
-	0x02, 0x0a, 0x15, 0x49, 0x6e, 0x67, 0x65, 0x73, 0x74, 0x49, 0x6e, 0x63, 0x69, 0x64, 0x65, 0x6e,
-	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x69, 0x74, 0x6c,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x12, 0x20,
-	0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x19, 0x0a, 0x08, 0x72, 0x61, 0x77, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x72, 0x61, 0x77, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1a, 0x0a, 0x08, 0x73,
-	0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x73,
-	0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x72, 0x69, 0x67, 0x69,
-	0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x12,
-	0x24, 0x0a, 0x0b, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0a, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c,
-	0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x26, 0x0a, 0x0c, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61,
-	0x6c, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0b, 0x6f,
-	0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x42, 0x0e, 0x0a,
-	0x0c, 0x5f, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x42, 0x0f, 0x0a,
-	0x0d, 0x5f, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x75, 0x72, 0x6c, 0x22, 0x18,
-	0x0a, 0x16, 0x49, 0x6e, 0x67, 0x65, 0x73, 0x74, 0x49, 0x6e, 0x63, 0x69, 0x64, 0x65, 0x6e, 0x74,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x20, 0x0a, 0x1e, 0x46, 0x65, 0x74, 0x63,
-	0x68, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x77, 0x0a, 0x1f, 0x46, 0x65,
-	0x74, 0x63, 0x68, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x54, 0x0a,
-	0x0d, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e,
-	0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2e, 0x76,
-	0x31, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x32, 0x80, 0x03, 0x0a, 0x15, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x41, 0x50, 0x49, 0x73, 0x56, 0x31, 0x53, 0x72, 0x76, 0x12, 0x55, 0x0a,
-	0x02, 0x48, 0x5a, 0x12, 0x25, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e,
-	0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2e, 0x76, 0x31,
-	0x2e, 0x48, 0x5a, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x72, 0x65, 0x64,
-	0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x5a, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x12, 0x79, 0x0a, 0x0e, 0x49, 0x6e, 0x67, 0x65, 0x73, 0x74, 0x49, 0x6e,
-	0x63, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x12, 0x31, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62,
-	0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x2e, 0x76, 0x31, 0x2e, 0x49, 0x6e, 0x67, 0x65, 0x73, 0x74, 0x49, 0x6e, 0x63, 0x69, 0x64, 0x65,
-	0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x72, 0x65, 0x64, 0x63,
-	0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x6e, 0x67, 0x65, 0x73, 0x74, 0x49, 0x6e, 0x63,
-	0x69, 0x64, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x94, 0x01, 0x0a, 0x17, 0x46, 0x65, 0x74, 0x63, 0x68, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3a, 0x2e, 0x72, 0x65,
-	0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x2e, 0x76, 0x31, 0x2e, 0x46, 0x65, 0x74, 0x63, 0x68, 0x41, 0x67,
-	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3b, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72,
-	0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x2e, 0x76, 0x31, 0x2e, 0x46, 0x65, 0x74, 0x63, 0x68, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xf2, 0x01, 0x0a, 0x1e, 0x63, 0x6f, 0x6d, 0x2e, 0x72,
-	0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f,
-	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2e, 0x76, 0x31, 0x42, 0x07, 0x56, 0x31, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x50, 0x01, 0x5a, 0x41, 0x70, 0x6b, 0x67, 0x2e, 0x72, 0x65, 0x64, 0x63, 0x61, 0x72,
-	0x62, 0x6f, 0x6e, 0x2e, 0x61, 0x69, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x72, 0x65, 0x64,
-	0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2f, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x2f, 0x76, 0x31, 0x3b, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x5f, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x52, 0x41, 0x58, 0xaa, 0x02, 0x19,
-	0x52, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x19, 0x52, 0x65, 0x64, 0x63,
-	0x61, 0x72, 0x62, 0x6f, 0x6e, 0x5c, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x50, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x25, 0x52, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f,
-	0x6e, 0x5c, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5c, 0x56,
-	0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1b,
-	0x52, 0x65, 0x64, 0x63, 0x61, 0x72, 0x62, 0x6f, 0x6e, 0x3a, 0x3a, 0x41, 0x67, 0x65, 0x6e, 0x74,
-	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+type FetchAgentRequestsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Requests      []*AgentRequest        `protobuf:"bytes,1,rep,name=requests,proto3" json:"requests,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
+func (x *FetchAgentRequestsResponse) Reset() {
+	*x = FetchAgentRequestsResponse{}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *FetchAgentRequestsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FetchAgentRequestsResponse) ProtoMessage() {}
+
+func (x *FetchAgentRequestsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FetchAgentRequestsResponse.ProtoReflect.Descriptor instead.
+func (*FetchAgentRequestsResponse) Descriptor() ([]byte, []int) {
+	return file_redcarbon_agents_public_v1_v1_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *FetchAgentRequestsResponse) GetRequests() []*AgentRequest {
+	if x != nil {
+		return x.Requests
+	}
+	return nil
+}
+
+type SubmitAgentResponseRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RequestId     string                 `protobuf:"bytes,1,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
+	Response      *AgentResponse         `protobuf:"bytes,2,opt,name=response,proto3" json:"response,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SubmitAgentResponseRequest) Reset() {
+	*x = SubmitAgentResponseRequest{}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SubmitAgentResponseRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SubmitAgentResponseRequest) ProtoMessage() {}
+
+func (x *SubmitAgentResponseRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SubmitAgentResponseRequest.ProtoReflect.Descriptor instead.
+func (*SubmitAgentResponseRequest) Descriptor() ([]byte, []int) {
+	return file_redcarbon_agents_public_v1_v1_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *SubmitAgentResponseRequest) GetRequestId() string {
+	if x != nil {
+		return x.RequestId
+	}
+	return ""
+}
+
+func (x *SubmitAgentResponseRequest) GetResponse() *AgentResponse {
+	if x != nil {
+		return x.Response
+	}
+	return nil
+}
+
+type SubmitAgentResponseResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SubmitAgentResponseResponse) Reset() {
+	*x = SubmitAgentResponseResponse{}
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SubmitAgentResponseResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SubmitAgentResponseResponse) ProtoMessage() {}
+
+func (x *SubmitAgentResponseResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_redcarbon_agents_public_v1_v1_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SubmitAgentResponseResponse.ProtoReflect.Descriptor instead.
+func (*SubmitAgentResponseResponse) Descriptor() ([]byte, []int) {
+	return file_redcarbon_agents_public_v1_v1_proto_rawDescGZIP(), []int{9}
+}
+
+var File_redcarbon_agents_public_v1_v1_proto protoreflect.FileDescriptor
+
+const file_redcarbon_agents_public_v1_v1_proto_rawDesc = "" +
+	"\n" +
+	"#redcarbon/agents_public/v1/v1.proto\x12\x1aredcarbon.agents_public.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a&redcarbon/agents_public/v1/types.proto\"7\n" +
+	"\tHZRequest\x12\x1a\n" +
+	"\bhostname\x18\x01 \x01(\tR\bhostname\x12\x0e\n" +
+	"\x02ip\x18\x02 \x01(\tR\x02ip\"I\n" +
+	"\n" +
+	"HZResponse\x12;\n" +
+	"\vreceived_at\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
+	"receivedAt\"\x8d\x02\n" +
+	"\x15IngestIncidentRequest\x12\x14\n" +
+	"\x05title\x18\x01 \x01(\tR\x05title\x12 \n" +
+	"\vdescription\x18\x02 \x01(\tR\vdescription\x12\x19\n" +
+	"\braw_data\x18\x03 \x01(\tR\arawData\x12\x1a\n" +
+	"\bseverity\x18\x04 \x01(\rR\bseverity\x12\x16\n" +
+	"\x06origin\x18\x05 \x01(\tR\x06origin\x12$\n" +
+	"\voriginal_id\x18\x06 \x01(\tH\x00R\n" +
+	"originalId\x88\x01\x01\x12&\n" +
+	"\foriginal_url\x18\a \x01(\tH\x01R\voriginalUrl\x88\x01\x01B\x0e\n" +
+	"\f_original_idB\x0f\n" +
+	"\r_original_url\"\x18\n" +
+	"\x16IngestIncidentResponse\" \n" +
+	"\x1eFetchAgentConfigurationRequest\"w\n" +
+	"\x1fFetchAgentConfigurationResponse\x12T\n" +
+	"\rconfiguration\x18\x01 \x01(\v2..redcarbon.agents_public.v1.AgentConfigurationR\rconfiguration\"\x1b\n" +
+	"\x19FetchAgentRequestsRequest\"b\n" +
+	"\x1aFetchAgentRequestsResponse\x12D\n" +
+	"\brequests\x18\x01 \x03(\v2(.redcarbon.agents_public.v1.AgentRequestR\brequests\"\x82\x01\n" +
+	"\x1aSubmitAgentResponseRequest\x12\x1d\n" +
+	"\n" +
+	"request_id\x18\x01 \x01(\tR\trequestId\x12E\n" +
+	"\bresponse\x18\x02 \x01(\v2).redcarbon.agents_public.v1.AgentResponseR\bresponse\"\x1d\n" +
+	"\x1bSubmitAgentResponseResponse2\x93\x05\n" +
+	"\x15AgentsPublicAPIsV1Srv\x12U\n" +
+	"\x02HZ\x12%.redcarbon.agents_public.v1.HZRequest\x1a&.redcarbon.agents_public.v1.HZResponse\"\x00\x12y\n" +
+	"\x0eIngestIncident\x121.redcarbon.agents_public.v1.IngestIncidentRequest\x1a2.redcarbon.agents_public.v1.IngestIncidentResponse\"\x00\x12\x94\x01\n" +
+	"\x17FetchAgentConfiguration\x12:.redcarbon.agents_public.v1.FetchAgentConfigurationRequest\x1a;.redcarbon.agents_public.v1.FetchAgentConfigurationResponse\"\x00\x12\x85\x01\n" +
+	"\x12FetchAgentRequests\x125.redcarbon.agents_public.v1.FetchAgentRequestsRequest\x1a6.redcarbon.agents_public.v1.FetchAgentRequestsResponse\"\x00\x12\x88\x01\n" +
+	"\x13SubmitAgentResponse\x126.redcarbon.agents_public.v1.SubmitAgentResponseRequest\x1a7.redcarbon.agents_public.v1.SubmitAgentResponseResponse\"\x00B\xf2\x01\n" +
+	"\x1ecom.redcarbon.agents_public.v1B\aV1ProtoP\x01ZApkg.redcarbon.ai/proto/redcarbon/agents_public/v1;agents_publicv1\xa2\x02\x03RAX\xaa\x02\x19Redcarbon.AgentsPublic.V1\xca\x02\x19Redcarbon\\AgentsPublic\\V1\xe2\x02%Redcarbon\\AgentsPublic\\V1\\GPBMetadata\xea\x02\x1bRedcarbon::AgentsPublic::V1b\x06proto3"
+
 var (
 	file_redcarbon_agents_public_v1_v1_proto_rawDescOnce sync.Once
-	file_redcarbon_agents_public_v1_v1_proto_rawDescData = file_redcarbon_agents_public_v1_v1_proto_rawDesc
+	file_redcarbon_agents_public_v1_v1_proto_rawDescData []byte
 )
 
 func file_redcarbon_agents_public_v1_v1_proto_rawDescGZIP() []byte {
 	file_redcarbon_agents_public_v1_v1_proto_rawDescOnce.Do(func() {
-		file_redcarbon_agents_public_v1_v1_proto_rawDescData = protoimpl.X.CompressGZIP(file_redcarbon_agents_public_v1_v1_proto_rawDescData)
+		file_redcarbon_agents_public_v1_v1_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_redcarbon_agents_public_v1_v1_proto_rawDesc), len(file_redcarbon_agents_public_v1_v1_proto_rawDesc)))
 	})
 	return file_redcarbon_agents_public_v1_v1_proto_rawDescData
 }
 
-var file_redcarbon_agents_public_v1_v1_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_redcarbon_agents_public_v1_v1_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
 var file_redcarbon_agents_public_v1_v1_proto_goTypes = []any{
 	(*HZRequest)(nil),                       // 0: redcarbon.agents_public.v1.HZRequest
 	(*HZResponse)(nil),                      // 1: redcarbon.agents_public.v1.HZResponse
@@ -452,23 +557,35 @@ var file_redcarbon_agents_public_v1_v1_proto_goTypes = []any{
 	(*IngestIncidentResponse)(nil),          // 3: redcarbon.agents_public.v1.IngestIncidentResponse
 	(*FetchAgentConfigurationRequest)(nil),  // 4: redcarbon.agents_public.v1.FetchAgentConfigurationRequest
 	(*FetchAgentConfigurationResponse)(nil), // 5: redcarbon.agents_public.v1.FetchAgentConfigurationResponse
-	(*timestamppb.Timestamp)(nil),           // 6: google.protobuf.Timestamp
-	(*AgentConfiguration)(nil),              // 7: redcarbon.agents_public.v1.AgentConfiguration
+	(*FetchAgentRequestsRequest)(nil),       // 6: redcarbon.agents_public.v1.FetchAgentRequestsRequest
+	(*FetchAgentRequestsResponse)(nil),      // 7: redcarbon.agents_public.v1.FetchAgentRequestsResponse
+	(*SubmitAgentResponseRequest)(nil),      // 8: redcarbon.agents_public.v1.SubmitAgentResponseRequest
+	(*SubmitAgentResponseResponse)(nil),     // 9: redcarbon.agents_public.v1.SubmitAgentResponseResponse
+	(*timestamppb.Timestamp)(nil),           // 10: google.protobuf.Timestamp
+	(*AgentConfiguration)(nil),              // 11: redcarbon.agents_public.v1.AgentConfiguration
+	(*AgentRequest)(nil),                    // 12: redcarbon.agents_public.v1.AgentRequest
+	(*AgentResponse)(nil),                   // 13: redcarbon.agents_public.v1.AgentResponse
 }
 var file_redcarbon_agents_public_v1_v1_proto_depIdxs = []int32{
-	6, // 0: redcarbon.agents_public.v1.HZResponse.received_at:type_name -> google.protobuf.Timestamp
-	7, // 1: redcarbon.agents_public.v1.FetchAgentConfigurationResponse.configuration:type_name -> redcarbon.agents_public.v1.AgentConfiguration
-	0, // 2: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.HZ:input_type -> redcarbon.agents_public.v1.HZRequest
-	2, // 3: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.IngestIncident:input_type -> redcarbon.agents_public.v1.IngestIncidentRequest
-	4, // 4: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentConfiguration:input_type -> redcarbon.agents_public.v1.FetchAgentConfigurationRequest
-	1, // 5: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.HZ:output_type -> redcarbon.agents_public.v1.HZResponse
-	3, // 6: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.IngestIncident:output_type -> redcarbon.agents_public.v1.IngestIncidentResponse
-	5, // 7: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentConfiguration:output_type -> redcarbon.agents_public.v1.FetchAgentConfigurationResponse
-	5, // [5:8] is the sub-list for method output_type
-	2, // [2:5] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	2, // [2:2] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	10, // 0: redcarbon.agents_public.v1.HZResponse.received_at:type_name -> google.protobuf.Timestamp
+	11, // 1: redcarbon.agents_public.v1.FetchAgentConfigurationResponse.configuration:type_name -> redcarbon.agents_public.v1.AgentConfiguration
+	12, // 2: redcarbon.agents_public.v1.FetchAgentRequestsResponse.requests:type_name -> redcarbon.agents_public.v1.AgentRequest
+	13, // 3: redcarbon.agents_public.v1.SubmitAgentResponseRequest.response:type_name -> redcarbon.agents_public.v1.AgentResponse
+	0,  // 4: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.HZ:input_type -> redcarbon.agents_public.v1.HZRequest
+	2,  // 5: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.IngestIncident:input_type -> redcarbon.agents_public.v1.IngestIncidentRequest
+	4,  // 6: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentConfiguration:input_type -> redcarbon.agents_public.v1.FetchAgentConfigurationRequest
+	6,  // 7: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentRequests:input_type -> redcarbon.agents_public.v1.FetchAgentRequestsRequest
+	8,  // 8: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.SubmitAgentResponse:input_type -> redcarbon.agents_public.v1.SubmitAgentResponseRequest
+	1,  // 9: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.HZ:output_type -> redcarbon.agents_public.v1.HZResponse
+	3,  // 10: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.IngestIncident:output_type -> redcarbon.agents_public.v1.IngestIncidentResponse
+	5,  // 11: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentConfiguration:output_type -> redcarbon.agents_public.v1.FetchAgentConfigurationResponse
+	7,  // 12: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.FetchAgentRequests:output_type -> redcarbon.agents_public.v1.FetchAgentRequestsResponse
+	9,  // 13: redcarbon.agents_public.v1.AgentsPublicAPIsV1Srv.SubmitAgentResponse:output_type -> redcarbon.agents_public.v1.SubmitAgentResponseResponse
+	9,  // [9:14] is the sub-list for method output_type
+	4,  // [4:9] is the sub-list for method input_type
+	4,  // [4:4] is the sub-list for extension type_name
+	4,  // [4:4] is the sub-list for extension extendee
+	0,  // [0:4] is the sub-list for field type_name
 }
 
 func init() { file_redcarbon_agents_public_v1_v1_proto_init() }
@@ -477,88 +594,14 @@ func file_redcarbon_agents_public_v1_v1_proto_init() {
 		return
 	}
 	file_redcarbon_agents_public_v1_types_proto_init()
-	if !protoimpl.UnsafeEnabled {
-		file_redcarbon_agents_public_v1_v1_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*HZRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_v1_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*HZResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_v1_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*IngestIncidentRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_v1_proto_msgTypes[3].Exporter = func(v any, i int) any {
-			switch v := v.(*IngestIncidentResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_v1_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*FetchAgentConfigurationRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_redcarbon_agents_public_v1_v1_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*FetchAgentConfigurationResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	file_redcarbon_agents_public_v1_v1_proto_msgTypes[2].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_redcarbon_agents_public_v1_v1_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_redcarbon_agents_public_v1_v1_proto_rawDesc), len(file_redcarbon_agents_public_v1_v1_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   10,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -567,7 +610,6 @@ func file_redcarbon_agents_public_v1_v1_proto_init() {
 		MessageInfos:      file_redcarbon_agents_public_v1_v1_proto_msgTypes,
 	}.Build()
 	File_redcarbon_agents_public_v1_v1_proto = out.File
-	file_redcarbon_agents_public_v1_v1_proto_rawDesc = nil
 	file_redcarbon_agents_public_v1_v1_proto_goTypes = nil
 	file_redcarbon_agents_public_v1_v1_proto_depIdxs = nil
 }
diff --git a/response-2926994918.json b/response-2926994918.json
new file mode 100644
index 0000000..a2c53cb
--- /dev/null
+++ b/response-2926994918.json
@@ -0,0 +1 @@
+{"preview":false,"init_offset":0,"messages":[{"type":"INFO","text":"[FW-SIEM-INDEXER-01,FW-SIEM-INDEXER-02] The following csv lookup file for table 'asset_lookup_by_cidr' is empty: /opt/splunk/var/run/searchpeers/D23337C5-5962-422B-B407-38BC126DC7AA-1753791336/kvstore_s_SA-IdeRjww0FotymhlCIaS1cqkc05a_assetsUsLDHpCAlNCPKOnjIAACK5z5"}],"fields":[{"name":"BoundaryRanges"},{"name":"IsOutlier(failure)"},{"name":"Logon_ID"},{"name":"_bkt"},{"name":"_cd"},{"name":"_eventtype_color"},{"name":"_indextime"},{"name":"_raw"},{"name":"_risk_system"},{"name":"_risk_user"},{"name":"_serial"},{"name":"_si"},{"name":"_sourcetype"},{"name":"_time"},{"name":"action"},{"name":"all_risk_objects"},{"name":"analytic_story"},{"name":"annotations"},{"name":"annotations._all","type":"str"},{"name":"annotations._frameworks","type":"str"},{"name":"annotations.analytic_story"},{"name":"annotations.cis20"},{"name":"annotations.confidence"},{"name":"annotations.context"},{"name":"annotations.cve"},{"name":"annotations.data_source"},{"name":"annotations.impact"},{"name":"annotations.kill_chain_phases"},{"name":"annotations.mitre_attack"},{"name":"annotations.mitre_attack.mitre_description"},{"name":"annotations.mitre_attack.mitre_detection"},{"name":"annotations.mitre_attack.mitre_platform"},{"name":"annotations.mitre_attack.mitre_tactic"},{"name":"annotations.mitre_attack.mitre_tactic_id"},{"name":"annotations.mitre_attack.mitre_technique"},{"name":"annotations.mitre_attack.mitre_technique_id"},{"name":"annotations.mitre_attack.mitre_url"},{"name":"annotations.nist"},{"name":"annotations.nist_category"},{"name":"annotations.nist_function"},{"name":"annotations.type_list"},{"name":"app"},{"name":"category"},{"name":"cim_entity_zone"},{"name":"comment"},{"name":"connection_to_CNC"},{"name":"control","type":"str"},{"name":"count"},{"name":"customer_id"},{"name":"date_hour"},{"name":"date_mday"},{"name":"date_minute"},{"name":"date_month"},{"name":"date_second"},{"name":"date_wday"},{"name":"date_year"},{"name":"date_zone"},{"name":"default_disposition"},{"name":"default_owner"},{"name":"default_status"},{"name":"dest"},{"name":"dest_app"},{"name":"dest_asset"},{"name":"dest_asset_id"},{"name":"dest_asset_tag"},{"name":"dest_bunit"},{"name":"dest_category"},{"name":"dest_city"},{"name":"dest_count"},{"name":"dest_country"},{"name":"dest_dns"},{"name":"dest_domain"},{"name":"dest_ip"},{"name":"dest_is_expected"},{"name":"dest_lat"},{"name":"dest_long"},{"name":"dest_mac"},{"name":"dest_notes"},{"name":"dest_nt_host"},{"name":"dest_os_version"},{"name":"dest_owner"},{"name":"dest_pci_domain"},{"name":"dest_port"},{"name":"dest_priority"},{"name":"dest_requires_av"},{"name":"dest_risk_object_type","type":"str"},{"name":"dest_risk_score","type":"str"},{"name":"dest_should_timesync"},{"name":"dest_should_update"},{"name":"dest_time"},{"name":"detection_type"},{"name":"disposition","type":"str"},{"name":"disposition_default","type":"str"},{"name":"disposition_description","type":"str"},{"name":"disposition_label","type":"str"},{"name":"distance"},{"name":"drilldown_dashboards"},{"name":"drilldown_earliest","type":"str"},{"name":"drilldown_earliest_offset"},{"name":"drilldown_latest","type":"str"},{"name":"drilldown_latest_offset"},{"name":"drilldown_name"},{"name":"drilldown_search"},{"name":"drilldown_searches"},{"name":"event_id","type":"str"},{"name":"eventtype"},{"name":"extract_artifacts"},{"name":"failure"},{"name":"firstTime"},{"name":"governance","type":"str"},{"name":"host"},{"name":"index"},{"name":"info_max_time"},{"name":"info_min_time"},{"name":"info_search_time"},{"name":"investigation_profiles"},{"name":"killchain"},{"name":"lastTime"},{"name":"linecount"},{"name":"mitre_sub_technique"},{"name":"mitre_sub_technique_description"},{"name":"mitre_tactic_description"},{"name":"mitre_tactic_id_count"},{"name":"mitre_technique_description"},{"name":"mitre_technique_id_count"},{"name":"next_steps"},{"name":"normalized_risk_object","type":"str"},{"name":"notable_type","type":"str"},{"name":"notable_xref_id"},{"name":"notable_xref_name"},{"name":"num_dest_ip"},{"name":"num_dest_port"},{"name":"num_dest_server"},{"name":"num_queries"},{"name":"orig_action_name"},{"name":"orig_bkt"},{"name":"orig_cd"},{"name":"orig_event_id"},{"name":"orig_investigation_type"},{"name":"orig_raw"},{"name":"orig_rid"},{"name":"orig_rule_description"},{"name":"orig_rule_title"},{"name":"orig_security_domain"},{"name":"orig_sid"},{"name":"orig_source","type":"str"},{"name":"orig_tag"},{"name":"orig_time"},{"name":"original_file_name"},{"name":"owner","type":"str"},{"name":"owner_realname","type":"str"},{"name":"parent_process"},{"name":"parent_process_exec"},{"name":"parent_process_guid"},{"name":"parent_process_id"},{"name":"parent_process_name"},{"name":"parent_process_path"},{"name":"priorities","type":"str"},{"name":"priority","type":"str"},{"name":"process"},{"name":"process_exec"},{"name":"process_guid"},{"name":"process_hash"},{"name":"process_id"},{"name":"process_integrity_level"},{"name":"process_name"},{"name":"process_path"},{"name":"recommended_actions"},{"name":"reliability"},{"name":"result"},{"name":"review_time"},{"name":"reviewer"},{"name":"risk_event_count"},{"name":"risk_object"},{"name":"risk_object_asset"},{"name":"risk_object_asset_id"},{"name":"risk_object_asset_tag"},{"name":"risk_object_bunit"},{"name":"risk_object_category"},{"name":"risk_object_city"},{"name":"risk_object_country"},{"name":"risk_object_dns"},{"name":"risk_object_domain"},{"name":"risk_object_email"},{"name":"risk_object_endDate"},{"name":"risk_object_first"},{"name":"risk_object_identity"},{"name":"risk_object_identity_id"},{"name":"risk_object_identity_tag"},{"name":"risk_object_ip"},{"name":"risk_object_is_expected"},{"name":"risk_object_last"},{"name":"risk_object_lat"},{"name":"risk_object_long"},{"name":"risk_object_mac"},{"name":"risk_object_managedBy"},{"name":"risk_object_nick"},{"name":"risk_object_notes"},{"name":"risk_object_nt_host"},{"name":"risk_object_os_version"},{"name":"risk_object_owner"},{"name":"risk_object_pci_domain"},{"name":"risk_object_phone"},{"name":"risk_object_prefix"},{"name":"risk_object_priority"},{"name":"risk_object_requires_av"},{"name":"risk_object_should_timesync"},{"name":"risk_object_should_update"},{"name":"risk_object_startDate"},{"name":"risk_object_suffix"},{"name":"risk_object_system"},{"name":"risk_object_type"},{"name":"risk_object_watchlist"},{"name":"risk_object_work_city"},{"name":"risk_object_work_country"},{"name":"risk_object_work_lat"},{"name":"risk_object_work_long"},{"name":"risk_score","type":"str"},{"name":"risk_threshold"},{"name":"rule"},{"name":"rule_description","type":"str"},{"name":"rule_id","type":"str"},{"name":"rule_name","type":"str"},{"name":"rule_title","type":"str"},{"name":"savedsearch_description"},{"name":"search_name"},{"name":"search_title"},{"name":"security_domain","type":"str"},{"name":"service_count"},{"name":"severities","type":"str"},{"name":"severity","type":"str"},{"name":"showcaseId"},{"name":"showcaseName"},{"name":"source"},{"name":"source_count"},{"name":"source_event_id"},{"name":"source_guid"},{"name":"sourcetype"},{"name":"speed"},{"name":"splunk_server"},{"name":"splunk_server_group"},{"name":"src"},{"name":"src_app"},{"name":"src_asset"},{"name":"src_asset_id"},{"name":"src_asset_tag"},{"name":"src_bunit"},{"name":"src_category"},{"name":"src_city"},{"name":"src_country"},{"name":"src_dns"},{"name":"src_domain"},{"name":"src_ip"},{"name":"src_is_expected"},{"name":"src_lat"},{"name":"src_long"},{"name":"src_mac"},{"name":"src_notes"},{"name":"src_nt_host"},{"name":"src_os_version"},{"name":"src_owner"},{"name":"src_pci_domain"},{"name":"src_priority"},{"name":"src_requires_av"},{"name":"src_risk_object_type","type":"str"},{"name":"src_risk_score","type":"num"},{"name":"src_should_timesync"},{"name":"src_should_update"},{"name":"src_time"},{"name":"status","type":"str"},{"name":"status_default","type":"str"},{"name":"status_description","type":"str"},{"name":"status_end","type":"str"},{"name":"status_group","type":"str"},{"name":"status_label","type":"str"},{"name":"subject"},{"name":"success"},{"name":"suppression"},{"name":"tag","type":"str"},{"name":"tag::action"},{"name":"tag::app"},{"name":"tag::dest_requires_av"},{"name":"tag::dest_should_timesync"},{"name":"tag::dest_should_update"},{"name":"tag::eventtype"},{"name":"tag::user_category"},{"name":"tag::user_identity_tag"},{"name":"tag::user_watchlist"},{"name":"time"},{"name":"timeendpos"},{"name":"timestartpos"},{"name":"urgency","type":"str"},{"name":"user"},{"name":"user_bunit"},{"name":"user_category"},{"name":"user_count"},{"name":"user_email"},{"name":"user_endDate"},{"name":"user_first"},{"name":"user_id"},{"name":"user_identity"},{"name":"user_identity_id"},{"name":"user_identity_tag"},{"name":"user_last"},{"name":"user_managedBy"},{"name":"user_nick"},{"name":"user_phone"},{"name":"user_prefix"},{"name":"user_priority"},{"name":"user_risk_object_type","type":"str"},{"name":"user_risk_score","type":"num"},{"name":"user_startDate"},{"name":"user_suffix"},{"name":"user_watchlist"},{"name":"user_work_city"},{"name":"user_work_country"},{"name":"user_work_lat"},{"name":"user_work_long"},{"name":"values(DnsHostName)"},{"name":"values(EventCode)"},{"name":"values(MSADChangedAttributes)"},{"name":"values(NewUacValue)"},{"name":"values(OldUacValue)"},{"name":"values(PrimaryGroupId)"},{"name":"values(SamAccountName)"},{"name":"values(TargetDomainName)"},{"name":"vendor_product"}],"results":[{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:476232","_eventtype_color":"none","_indextime":"1753702986","_raw":"1753702982, search_name=\"Endpoint - FW - ESCU - Create or delete windows shares using net exe - Rule - Rule\", _time=\"1753702982\", annotations=\"{\\\"analytic_story\\\":[\\\"Hidden Cobra Malware\\\",\\\"CISA AA22-277A\\\",\\\"Windows Post-Exploitation\\\",\\\"Prestige Ransomware\\\",\\\"DarkGate Malware\\\"],\\\"cis20\\\":[\\\"CIS 10\\\"],\\\"kill_chain_phases\\\":[\\\"Exploitation\\\"],\\\"mitre_attack\\\":[\\\"T1070.005\\\"],\\\"nist\\\":[\\\"DE.CM\\\"],\\\"data_source\\\":[\\\"Sysmon EventID 1\\\",\\\"Windows Event Log Security 4688\\\",\\\"CrowdStrike ProcessRollup2\\\"],\\\"type_list\\\":[\\\"TTP\\\"]}\", annotations.analytic_story=\"Hidden Cobra Malware;CISA AA22-277A;Windows Post-Exploitation;Prestige Ransomware;DarkGate Malware\", annotations.cis20=\"CIS 10\", annotations.data_source=\"Sysmon EventID 1;Windows Event Log Security 4688;CrowdStrike ProcessRollup2\", annotations.kill_chain_phases=\"Exploitation\", annotations.mitre_attack=\"T1070.005\", annotations.nist=\"DE.CM\", annotations.type_list=\"TTP\", count=\"1\", customer_id=\"ST91552\", dest=\"ISMETT-DESKCE.ad.ismett.it\", firstTime=\"2025-07-28T12:35:59\", info_max_time=\"1753699800.000000000\", info_min_time=\"1753696200.000000000\", info_search_time=\"1753702979.960762000\", lastTime=\"2025-07-28T12:35:59\", orig_time=\"1753702982\", original_file_name=\"net1.exe\", parent_process=\"C:\\\\WINDOWS\\\\system32\\\\net.exe share Temp_1753689439387 /DELETE /y\", parent_process_name=\"net.exe\", process=\"C:\\\\WINDOWS\\\\system32\\\\net1 share Temp_1753689439387 /DELETE /y\", process_name=\"net1.exe\", orig_rule_description=\"The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.\", orig_rule_title=\"Create or delete windows shares using net exe\", orig_security_domain=\"endpoint\", severity=\"high\", source_event_id=\"e0cd7b7c-84e0-43c2-949b-be2b6e4154e3@@notable@@e0cd7b7c84e043c2949bbe2b6e4154e3\", source_guid=\"e0cd7b7c-84e0-43c2-949b-be2b6e4154e3\", user=\"SYSTEM\"","_serial":"0","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:43:02.000+02:00","annotations":"{\"analytic_story\":[\"Hidden Cobra Malware\",\"CISA AA22-277A\",\"Windows Post-Exploitation\",\"Prestige Ransomware\",\"DarkGate Malware\"],\"cis20\":[\"CIS 10\"],\"kill_chain_phases\":[\"Exploitation\"],\"mitre_attack\":[\"T1070.005\"],\"nist\":[\"DE.CM\"],\"data_source\":[\"Sysmon EventID 1\",\"Windows Event Log Security 4688\",\"CrowdStrike ProcessRollup2\"],\"type_list\":[\"TTP\"]}","annotations._all":["Hidden Cobra Malware","CISA AA22-277A","Windows Post-Exploitation","Prestige Ransomware","DarkGate Malware","CIS 10","Sysmon EventID 1","Windows Event Log Security 4688","CrowdStrike ProcessRollup2","Exploitation","T1070.005","DE.CM","TTP"],"annotations._frameworks":["analytic_story","cis20","kill_chain_phases","mitre_attack","nist","data_source","type_list"],"annotations.analytic_story":["Hidden Cobra Malware","CISA AA22-277A","Windows Post-Exploitation","Prestige Ransomware","DarkGate Malware"],"annotations.cis20":"CIS 10","annotations.data_source":["Sysmon EventID 1","Windows Event Log Security 4688","CrowdStrike ProcessRollup2"],"annotations.kill_chain_phases":"Exploitation","annotations.mitre_attack":"T1070.005","annotations.mitre_attack.mitre_description":"Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\\\system\\share /delete<\/code> command. (Citation: Technet Net Use)","annotations.mitre_attack.mitre_detection":"Network share connections may be common depending on how an network environment is used. Monitor command-line invocation of <code>net use<\/code> commands associated with establishing and removing remote shares over SMB, including following best practices for detection of [Windows Admin Shares](https://attack.mitre.org/techniques/T1077). SMB traffic between systems may also be captured and decoded to look for related network share session and file transfer activity. Windows authentication logs are also useful in determining when authenticated network shares are established and by which account, and can be used to correlate network share activity to other events to investigate potentially malicious activity.","annotations.mitre_attack.mitre_platform":"Windows","annotations.mitre_attack.mitre_tactic":"defense-evasion","annotations.mitre_attack.mitre_tactic_id":"TA0005","annotations.mitre_attack.mitre_technique":"Network Share Connection Removal","annotations.mitre_attack.mitre_technique_id":"T1070.005","annotations.mitre_attack.mitre_url":"https://attack.mitre.org/techniques/T1070/005","annotations.nist":"DE.CM","annotations.nist_category":"Continuous Monitoring","annotations.nist_function":"Detect(DE)","annotations.type_list":"TTP","cim_entity_zone":"ST91552","count":"1","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"43","date_month":"july","date_second":"2","date_wday":"monday","date_year":"2025","date_zone":"0","dest":"ISMETT-DESKCE.ad.ismett.it","dest_risk_object_type":"system","dest_risk_score":"73002935068078960000000000000.0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753696200.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753699800.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View Windows shared creation or deletion using net.exe on \\\"$dest$\\\" by \\\"$user$\\\"\",\"search\":\"| from datamodel:\\\"Endpoint.Processes\\\"\\n| search customer_id=\\\"$customer_id$\\\" dest=\\\"$dest$\\\" user=\\\"$user$\\\" process_name=\\\"$process_name$\\\" parent_process_name=\\\"$parent_process_name$\\\" original_file_name=\\\"$original_file_name$\\\"\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"},{\"name\":\"View the detection results for - \\\"$user$\\\" and \\\"$dest$\\\"\",\"search\":\"| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.customer_id\\n| `drop_dm_object_name(Processes)` \\n| `security_content_ctime(firstTime)` \\n| `security_content_ctime(lastTime)` \\n| search process IN (\\\"*share* /delete*\\\", \\\"*share* /REMARK:*\\\", \\\"*share* /CACHE:*\\\") \\n| `create_or_delete_windows_shares_using_net_exe_filter` \\n| search customer_id=\\\"$customer_id$\\\" user = \\\"$user$\\\" dest = \\\"$dest$\\\"\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"},{\"name\":\"View risk events for the last 7 days for - \\\"$user$\\\" and \\\"$dest$\\\"\",\"search\":\"| from datamodel Risk.All_Risk \\n| search normalized_risk_object IN (\\\"$user$\\\", \\\"$dest$\\\") starthoursago=168 \\n| stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as \\\"Search Name\\\" values(risk_message) as \\\"Risk Message\\\" values(analyticstories) as \\\"Analytic Stories\\\" values(annotations._all) as \\\"Annotations\\\" values(annotations.mitre_attack.mitre_tactic) as \\\"ATT&CK Tactics\\\" by normalized_risk_object \\n| `security_content_ctime(firstTime)` \\n| `security_content_ctime(lastTime)`\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"e0cd7b7c-84e0-43c2-949b-be2b6e4154e3@@notable@@e0cd7b7c84e043c2949bbe2b6e4154e3","eventtype":["check_customer_id_ST91552","modnotable_results","notable"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\"],\"identity\":[\"src_user\",\"user\",\"src_user_id\",\"src_user_role\",\"user_id\",\"user_role\",\"vendor_account\"]}","firstTime":"2025-07-28T12:35:59","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753699800.000000000","info_min_time":"1753696200.000000000","info_search_time":"1753702979.960762000","investigation_profiles":"{}","lastTime":"2025-07-28T12:35:59","linecount":"1","notable_type":"notable","orig_action_name":"notable","orig_rid":"0","orig_rule_description":"The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.","orig_rule_title":"Create or delete windows shares using net exe","orig_security_domain":"endpoint","orig_sid":"scheduler__admin__SplunkEnterpriseSecuritySuite__RMD5b1f65f20c2a7df73_at_1753700400_1785_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_time":"1753702982","original_file_name":"net1.exe","owner":"unassigned","owner_realname":"unassigned","parent_process":"C:\\WINDOWS\\system32\\net.exe share Temp_1753689439387 /DELETE /y","parent_process_name":"net.exe","priority":"unknown","process":"C:\\WINDOWS\\system32\\net1 share Temp_1753689439387 /DELETE /y","process_name":"net1.exe","risk_score":"1293037231703144700000000000000000000.0","rule_description":"The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.","rule_id":"e0cd7b7c-84e0-43c2-949b-be2b6e4154e3@@notable@@e0cd7b7c84e043c2949bbe2b6e4154e3","rule_name":"FW - ESCU - Create or delete windows shares using net exe - Rule","rule_title":"Create or delete windows shares using net exe","savedsearch_description":"The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.","search_name":"Endpoint - FW - ESCU - Create or delete windows shares using net exe - Rule - Rule","security_domain":"endpoint","severities":"high","severity":"high","source":"Endpoint - FW - ESCU - Create or delete windows shares using net exe - Rule - Rule","source_event_id":"e0cd7b7c-84e0-43c2-949b-be2b6e4154e3@@notable@@e0cd7b7c84e043c2949bbe2b6e4154e3","source_guid":"e0cd7b7c-84e0-43c2-949b-be2b6e4154e3","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702982","timeendpos":"232","timestartpos":"222","urgency":"medium","user":"SYSTEM","user_risk_object_type":"user","user_risk_score":"1293037231703144700000000000000000000.0"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:476183","_eventtype_color":"none","_indextime":"1753702810","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"192.168.101.32\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"webproxy.ad.ismett.it_ST91552\", orig_time=\"1753702806\", risk_event_count=\"7\", risk_object=\"192.168.101.32\", risk_object_type=\"system\", risk_score=\"2400727818677785100000000000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=192.168.101.32\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", orig_source=\"Threat - FW - Threat Activity Detected - Risk - Rule\", source_count=\"2\", source_event_id=\"5de2fbac-62c2-4f58-ab59-23789250c6ed@@notable@@5de2fbac62c24f58ab5923789250c6ed\", source_guid=\"5de2fbac-62c2-4f58-ab59-23789250c6ed\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"192.168.101.32","_serial":"1","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"192.168.101.32","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"5de2fbac-62c2-4f58-ab59-23789250c6ed@@notable@@5de2fbac62c24f58ab5923789250c6ed","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"webproxy.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"7","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=192.168.101.32","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":["Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","Threat - FW - Threat Activity Detected - Risk - Rule"],"orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"7","risk_object":"192.168.101.32","risk_object_asset":["webproxy.ad.ismett.it","192.168.101.32","webproxy"],"risk_object_asset_id":"647f43521ec6904877781bf9","risk_object_asset_tag":["linux","produzione","rev proxy/external dns","expected"],"risk_object_category":["linux","produzione","rev proxy/external dns"],"risk_object_dns":"webproxy.ad.ismett.it","risk_object_domain":"fuori dominio /dmz","risk_object_ip":"192.168.101.32","risk_object_is_expected":"true","risk_object_notes":"dns esteno ismett.edu / reverse proxy","risk_object_nt_host":"webproxy","risk_object_os_version":"oracle linux server release 8.7","risk_object_pci_domain":"untrust","risk_object_priority":"medium","risk_object_type":"system","risk_score":"2400727818677785100000000000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"5de2fbac-62c2-4f58-ab59-23789250c6ed@@notable@@5de2fbac62c24f58ab5923789250c6ed","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"2","source_event_id":"5de2fbac-62c2-4f58-ab59-23789250c6ed@@notable@@5de2fbac62c24f58ab5923789250c6ed","source_guid":"5de2fbac-62c2-4f58-ab59-23789250c6ed","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:476142","_eventtype_color":"none","_indextime":"1753702807","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"20.65.193.78\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"20.65.193.78_ST91552\", orig_time=\"1753702806\", risk_event_count=\"4\", risk_object=\"20.65.193.78\", risk_object_type=\"system\", risk_score=\"5744322872034606000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=20.65.193.78\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"3a180f3d-1cd8-4116-b4f6-d32aaf05d22a@@notable@@3a180f3d1cd84116b4f6d32aaf05d22a\", source_guid=\"3a180f3d-1cd8-4116-b4f6-d32aaf05d22a\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"20.65.193.78","_serial":"2","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"20.65.193.78","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"3a180f3d-1cd8-4116-b4f6-d32aaf05d22a@@notable@@3a180f3d1cd84116b4f6d32aaf05d22a","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"20.65.193.78_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"6","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=20.65.193.78","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"20.65.193.78","risk_object_type":"system","risk_score":"5744322872034606000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"3a180f3d-1cd8-4116-b4f6-d32aaf05d22a@@notable@@3a180f3d1cd84116b4f6d32aaf05d22a","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"3a180f3d-1cd8-4116-b4f6-d32aaf05d22a@@notable@@3a180f3d1cd84116b4f6d32aaf05d22a","source_guid":"3a180f3d-1cd8-4116-b4f6-d32aaf05d22a","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:476101","_eventtype_color":"none","_indextime":"1753702807","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"20.65.193.252\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"20.65.193.252_ST91552\", orig_time=\"1753702806\", risk_event_count=\"4\", risk_object=\"20.65.193.252\", risk_object_type=\"system\", risk_score=\"115310537797180000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=20.65.193.252\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"2474a85f-b919-4e0f-8d5a-a8abaae53228@@notable@@2474a85fb9194e0f8d5aa8abaae53228\", source_guid=\"2474a85f-b919-4e0f-8d5a-a8abaae53228\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"20.65.193.252","_serial":"3","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"20.65.193.252","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"2474a85f-b919-4e0f-8d5a-a8abaae53228@@notable@@2474a85fb9194e0f8d5aa8abaae53228","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"20.65.193.252_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"5","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=20.65.193.252","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"20.65.193.252","risk_object_type":"system","risk_score":"115310537797180000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"2474a85f-b919-4e0f-8d5a-a8abaae53228@@notable@@2474a85fb9194e0f8d5aa8abaae53228","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"2474a85f-b919-4e0f-8d5a-a8abaae53228@@notable@@2474a85fb9194e0f8d5aa8abaae53228","source_guid":"2474a85f-b919-4e0f-8d5a-a8abaae53228","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:476060","_eventtype_color":"none","_indextime":"1753702807","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"20.65.193.189\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"20.65.193.189_ST91552\", orig_time=\"1753702806\", risk_event_count=\"4\", risk_object=\"20.65.193.189\", risk_object_type=\"system\", risk_score=\"1539857363760\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=20.65.193.189\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"f3166cd1-0d5d-4db1-87fc-e6d3075b5492@@notable@@f3166cd10d5d4db187fce6d3075b5492\", source_guid=\"f3166cd1-0d5d-4db1-87fc-e6d3075b5492\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"20.65.193.189","_serial":"4","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"20.65.193.189","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"f3166cd1-0d5d-4db1-87fc-e6d3075b5492@@notable@@f3166cd10d5d4db187fce6d3075b5492","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"20.65.193.189_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"4","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=20.65.193.189","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"20.65.193.189","risk_object_type":"system","risk_score":"1539857363760","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"f3166cd1-0d5d-4db1-87fc-e6d3075b5492@@notable@@f3166cd10d5d4db187fce6d3075b5492","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"f3166cd1-0d5d-4db1-87fc-e6d3075b5492@@notable@@f3166cd10d5d4db187fce6d3075b5492","source_guid":"f3166cd1-0d5d-4db1-87fc-e6d3075b5492","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:476019","_eventtype_color":"none","_indextime":"1753702807","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"192.168.31.34\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"192.168.31.34_ST91552\", orig_time=\"1753702806\", risk_event_count=\"4\", risk_object=\"192.168.31.34\", risk_object_type=\"system\", risk_score=\"5214737093241600\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=192.168.31.34\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"56ad6d10-8a2f-421a-88b7-80659bc94828@@notable@@56ad6d108a2f421a88b780659bc94828\", source_guid=\"56ad6d10-8a2f-421a-88b7-80659bc94828\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"192.168.31.34","_serial":"5","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"192.168.31.34","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"56ad6d10-8a2f-421a-88b7-80659bc94828@@notable@@56ad6d108a2f421a88b780659bc94828","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"192.168.31.34_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"3","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=192.168.31.34","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"192.168.31.34","risk_object_type":"system","risk_score":"5214737093241600","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"56ad6d10-8a2f-421a-88b7-80659bc94828@@notable@@56ad6d108a2f421a88b780659bc94828","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"56ad6d10-8a2f-421a-88b7-80659bc94828@@notable@@56ad6d108a2f421a88b780659bc94828","source_guid":"56ad6d10-8a2f-421a-88b7-80659bc94828","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475970","_eventtype_color":"none","_indextime":"1753702807","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"192.168.182.23\", annotations.mitre_attack=\"None\", annotations.mitre_attack=\"T1110\", annotations.mitre_attack=\"T1201\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_tactic_id=\"TA0006\", annotations.mitre_attack.mitre_tactic_id=\"TA0007\", annotations.mitre_attack.mitre_technique_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"T1110\", annotations.mitre_attack.mitre_technique_id=\"T1201\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"3\", mitre_technique_id_count=\"3\", normalized_risk_object=\"192.168.182.23_ST91552\", orig_time=\"1753702806\", risk_event_count=\"3\", risk_object=\"192.168.182.23\", risk_object_type=\"system\", risk_score=\"2287540\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=192.168.182.23\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"bbec11c3-2ce0-450c-a53f-d645b29694c8@@notable@@bbec11c32ce0450ca53fd645b29694c8\", source_guid=\"bbec11c3-2ce0-450c-a53f-d645b29694c8\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"192.168.182.23","_serial":"6","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"192.168.182.23","annotations.mitre_attack.mitre_description":["Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.","Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)<\/code>, <code>Get-ADDefaultDomainPasswordPolicy<\/code>, <code>chage -l <username><\/code>, <code>cat /etc/pam.d/common-password<\/code>, and <code>pwpolicy getaccountpolicies<\/code> (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. <code>show aaa<\/code>, <code>show aaa common-criteria policy all<\/code>).(Citation: US-CERT-TA18-106A)\n\nPassword policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy<\/code> in AWS (Citation: AWS GetPasswordPolicy)."],"annotations.mitre_attack.mitre_detection":["Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.","Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity."],"annotations.mitre_attack.mitre_platform":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider","ESXi","Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"annotations.mitre_attack.mitre_tactic":["credential-access","discovery"],"annotations.mitre_attack.mitre_tactic_id":["None","TA0006","TA0007"],"annotations.mitre_attack.mitre_technique":["Brute Force","Password Policy Discovery"],"annotations.mitre_attack.mitre_technique_id":["None","T1110","T1201"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1110","https://attack.mitre.org/techniques/T1201"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"bbec11c3-2ce0-450c-a53f-d645b29694c8@@notable@@bbec11c32ce0450ca53fd645b29694c8","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"3","mitre_technique_id_count":"3","normalized_risk_object":"192.168.182.23_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"2","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=192.168.182.23","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"192.168.182.23","risk_object_type":"system","risk_score":"2287540","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"bbec11c3-2ce0-450c-a53f-d645b29694c8@@notable@@bbec11c32ce0450ca53fd645b29694c8","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"bbec11c3-2ce0-450c-a53f-d645b29694c8@@notable@@bbec11c32ce0450ca53fd645b29694c8","source_guid":"bbec11c3-2ce0-450c-a53f-d645b29694c8","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475929","_eventtype_color":"none","_indextime":"1753702807","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"192.168.106.69\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"192.168.106.69_ST91552\", orig_time=\"1753702806\", risk_event_count=\"4\", risk_object=\"192.168.106.69\", risk_object_type=\"system\", risk_score=\"2781311276389438400000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=192.168.106.69\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"e2091c76-b0f9-4fd1-bd4b-7ec4dc883436@@notable@@e2091c76b0f94fd1bd4b7ec4dc883436\", source_guid=\"e2091c76-b0f9-4fd1-bd4b-7ec4dc883436\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"192.168.106.69","_serial":"7","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"192.168.106.69","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"e2091c76-b0f9-4fd1-bd4b-7ec4dc883436@@notable@@e2091c76b0f94fd1bd4b7ec4dc883436","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"192.168.106.69_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"1","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=192.168.106.69","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"192.168.106.69","risk_object_type":"system","risk_score":"2781311276389438400000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"e2091c76-b0f9-4fd1-bd4b-7ec4dc883436@@notable@@e2091c76b0f94fd1bd4b7ec4dc883436","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"e2091c76-b0f9-4fd1-bd4b-7ec4dc883436@@notable@@e2091c76b0f94fd1bd4b7ec4dc883436","source_guid":"e2091c76-b0f9-4fd1-bd4b-7ec4dc883436","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475888","_eventtype_color":"none","_indextime":"1753702807","_raw":"1753702806, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753702806\", all_risk_objects=\"167.94.145.102\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753702200.000000000\", info_min_time=\"1753615800.000000000\", info_search_time=\"1753702800.852817000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"167.94.145.102_ST91552\", orig_time=\"1753702806\", risk_event_count=\"4\", risk_object=\"167.94.145.102\", risk_object_type=\"system\", risk_score=\"35952653594874920000000000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=167.94.145.102\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"10cae49c-cde4-4b17-b1a5-c0cd0e67542d@@notable@@10cae49ccde44b17b1a5c0cd0e67542d\", source_guid=\"10cae49c-cde4-4b17-b1a5-c0cd0e67542d\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"167.94.145.102","_serial":"8","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:40:06.000+02:00","all_risk_objects":"167.94.145.102","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"40","date_month":"july","date_second":"6","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753615800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753702200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"10cae49c-cde4-4b17-b1a5-c0cd0e67542d@@notable@@10cae49ccde44b17b1a5c0cd0e67542d","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753702200.000000000","info_min_time":"1753615800.000000000","info_search_time":"1753702800.852817000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"167.94.145.102_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"0","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=167.94.145.102","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753702800_1771_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753702806","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"167.94.145.102","risk_object_type":"system","risk_score":"35952653594874920000000000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"10cae49c-cde4-4b17-b1a5-c0cd0e67542d@@notable@@10cae49ccde44b17b1a5c0cd0e67542d","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"10cae49c-cde4-4b17-b1a5-c0cd0e67542d@@notable@@10cae49ccde44b17b1a5c0cd0e67542d","source_guid":"10cae49c-cde4-4b17-b1a5-c0cd0e67542d","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753702806","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475824","_eventtype_color":"none","_indextime":"1753701908","_raw":"1753701905, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701905\", all_risk_objects=\"srvats011\", annotations.mitre_attack=\"T1035\", annotations.mitre_attack=\"T1102\", annotations.mitre_attack=\"T1175\", annotations.mitre_attack=\"T1489\", annotations.mitre_attack=\"T1499\", annotations.mitre_attack.mitre_tactic_id=\"TA0002\", annotations.mitre_attack.mitre_tactic_id=\"TA0008\", annotations.mitre_attack.mitre_tactic_id=\"TA0011\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1035\", annotations.mitre_attack.mitre_technique_id=\"T1102\", annotations.mitre_attack.mitre_technique_id=\"T1175\", annotations.mitre_attack.mitre_technique_id=\"T1489\", annotations.mitre_attack.mitre_technique_id=\"T1499\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701300.000000000\", info_min_time=\"1753614900.000000000\", info_search_time=\"1753701901.837269000\", mitre_tactic_id_count=\"4\", mitre_technique_id_count=\"5\", normalized_risk_object=\"srvats011.ad.ismett.it_ST91552\", orig_time=\"1753701905\", risk_event_count=\"4\", risk_object=\"srvats011\", risk_object_type=\"system\", risk_score=\"2692725480\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=srvats011\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"48bb999e-a149-484d-912d-358482287e5e@@notable@@48bb999ea149484d912d358482287e5e\", source_guid=\"48bb999e-a149-484d-912d-358482287e5e\", orig_tag=\"ST91552\", orig_tag=\"application\", orig_tag=\"expected\", orig_tag=\"microsoft\", orig_tag=\"modaction_result\", orig_tag=\"produzione\"","_risk_system":"srvats011","_serial":"9","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:25:05.000+02:00","all_risk_objects":"srvats011","annotations.mitre_attack.mitre_description":["Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.","Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).","**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.","Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS<\/code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)","Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nAn Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nBotnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)\n\nIn cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)\n\nFor attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).\n"],"annotations.mitre_attack.mitre_detection":["Changes to service Registry entries and command-line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).","Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)","Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.\n\nMonitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.","Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\n\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code>. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\n\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, <code>ChangeServiceConfigW<\/code> may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)","Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.\n\nIn addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.\n\nExternally monitor the availability of services that may be targeted by an Endpoint DoS."],"annotations.mitre_attack.mitre_platform":["Windows","Linux","macOS","Windows","ESXi","Windows","Windows","Linux","macOS","ESXi","Windows","Linux","macOS","Containers","IaaS"],"annotations.mitre_attack.mitre_tactic":["execution","command-and-control","lateral-movement","execution","impact","impact"],"annotations.mitre_attack.mitre_tactic_id":["TA0002","TA0008","TA0011","TA0040"],"annotations.mitre_attack.mitre_technique":["Service Execution","Web Service","Component Object Model and Distributed COM","Service Stop","Endpoint Denial of Service"],"annotations.mitre_attack.mitre_technique_id":["T1035","T1102","T1175","T1489","T1499"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1035","https://attack.mitre.org/techniques/T1102","https://attack.mitre.org/techniques/T1175","https://attack.mitre.org/techniques/T1489","https://attack.mitre.org/techniques/T1499"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"25","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614900.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701300.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"48bb999e-a149-484d-912d-358482287e5e@@notable@@48bb999ea149484d912d358482287e5e","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753701300.000000000","info_min_time":"1753614900.000000000","info_search_time":"1753701901.837269000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"4","mitre_technique_id_count":"5","normalized_risk_object":"srvats011.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"3","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=srvats011","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701900_1741_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","application","expected","microsoft","modaction_result","produzione"],"orig_time":"1753701905","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"srvats011","risk_object_asset":["srvats011.ad.ismett.it","172.20.30.211","srvats011"],"risk_object_asset_id":"64f0a27832daf42fa4037701","risk_object_asset_tag":["microsoft","produzione","application","expected"],"risk_object_category":["microsoft","produzione","application"],"risk_object_dns":"srvats011.ad.ismett.it","risk_object_domain":"aditismett","risk_object_ip":"172.20.30.211","risk_object_is_expected":"true","risk_object_notes":"terminal server fisici bl 460 g9 ex hyperv 2012 per thinclient hp pocoperformanti (test virtual in produzione limitata)","risk_object_nt_host":"srvats011","risk_object_os_version":"windows server 2016 standard edition (x64)","risk_object_pci_domain":"untrust","risk_object_priority":"high","risk_object_type":"system","risk_score":"2692725480","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"48bb999e-a149-484d-912d-358482287e5e@@notable@@48bb999ea149484d912d358482287e5e","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"48bb999e-a149-484d-912d-358482287e5e@@notable@@48bb999ea149484d912d358482287e5e","source_guid":"48bb999e-a149-484d-912d-358482287e5e","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista","application","expected","microsoft","produzione"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701905","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475783","_eventtype_color":"none","_indextime":"1753701905","_raw":"1753701905, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701905\", all_risk_objects=\"206.168.34.89\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701300.000000000\", info_min_time=\"1753614900.000000000\", info_search_time=\"1753701901.837269000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"206.168.34.89_ST91552\", orig_time=\"1753701905\", risk_event_count=\"4\", risk_object=\"206.168.34.89\", risk_object_type=\"system\", risk_score=\"7080\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=206.168.34.89\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"ccad3c3d-ade2-45b8-9275-d5a2f1d92e2b@@notable@@ccad3c3dade245b89275d5a2f1d92e2b\", source_guid=\"ccad3c3d-ade2-45b8-9275-d5a2f1d92e2b\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"206.168.34.89","_serial":"10","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:25:05.000+02:00","all_risk_objects":"206.168.34.89","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"25","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614900.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701300.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"ccad3c3d-ade2-45b8-9275-d5a2f1d92e2b@@notable@@ccad3c3dade245b89275d5a2f1d92e2b","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753701300.000000000","info_min_time":"1753614900.000000000","info_search_time":"1753701901.837269000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"206.168.34.89_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"2","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=206.168.34.89","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701900_1741_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701905","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"206.168.34.89","risk_object_type":"system","risk_score":"7080","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"ccad3c3d-ade2-45b8-9275-d5a2f1d92e2b@@notable@@ccad3c3dade245b89275d5a2f1d92e2b","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"ccad3c3d-ade2-45b8-9275-d5a2f1d92e2b@@notable@@ccad3c3dade245b89275d5a2f1d92e2b","source_guid":"ccad3c3d-ade2-45b8-9275-d5a2f1d92e2b","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701905","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475742","_eventtype_color":"none","_indextime":"1753701905","_raw":"1753701905, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701905\", all_risk_objects=\"206.168.34.222\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701300.000000000\", info_min_time=\"1753614900.000000000\", info_search_time=\"1753701901.837269000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"206.168.34.222_ST91552\", orig_time=\"1753701905\", risk_event_count=\"4\", risk_object=\"206.168.34.222\", risk_object_type=\"system\", risk_score=\"16385280\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=206.168.34.222\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"b95145a7-344f-4bd5-a0e9-067d4776ce22@@notable@@b95145a7344f4bd5a0e9067d4776ce22\", source_guid=\"b95145a7-344f-4bd5-a0e9-067d4776ce22\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"206.168.34.222","_serial":"11","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:25:05.000+02:00","all_risk_objects":"206.168.34.222","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"25","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614900.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701300.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"b95145a7-344f-4bd5-a0e9-067d4776ce22@@notable@@b95145a7344f4bd5a0e9067d4776ce22","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753701300.000000000","info_min_time":"1753614900.000000000","info_search_time":"1753701901.837269000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"206.168.34.222_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"1","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=206.168.34.222","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701900_1741_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701905","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"206.168.34.222","risk_object_type":"system","risk_score":"16385280","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"b95145a7-344f-4bd5-a0e9-067d4776ce22@@notable@@b95145a7344f4bd5a0e9067d4776ce22","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"b95145a7-344f-4bd5-a0e9-067d4776ce22@@notable@@b95145a7344f4bd5a0e9067d4776ce22","source_guid":"b95145a7-344f-4bd5-a0e9-067d4776ce22","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701905","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475701","_eventtype_color":"none","_indextime":"1753701905","_raw":"1753701905, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701905\", all_risk_objects=\"167.94.145.107\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701300.000000000\", info_min_time=\"1753614900.000000000\", info_search_time=\"1753701901.837269000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"167.94.145.107_ST91552\", orig_time=\"1753701905\", risk_event_count=\"4\", risk_object=\"167.94.145.107\", risk_object_type=\"system\", risk_score=\"8578869335988747000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=167.94.145.107\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"3fb2233e-6285-47e2-9418-3896f5d9cd99@@notable@@3fb2233e628547e294183896f5d9cd99\", source_guid=\"3fb2233e-6285-47e2-9418-3896f5d9cd99\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"167.94.145.107","_serial":"12","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:25:05.000+02:00","all_risk_objects":"167.94.145.107","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"25","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614900.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701300.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"3fb2233e-6285-47e2-9418-3896f5d9cd99@@notable@@3fb2233e628547e294183896f5d9cd99","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753701300.000000000","info_min_time":"1753614900.000000000","info_search_time":"1753701901.837269000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"167.94.145.107_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"0","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=167.94.145.107","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701900_1741_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701905","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"167.94.145.107","risk_object_type":"system","risk_score":"8578869335988747000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"3fb2233e-6285-47e2-9418-3896f5d9cd99@@notable@@3fb2233e628547e294183896f5d9cd99","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"3fb2233e-6285-47e2-9418-3896f5d9cd99@@notable@@3fb2233e628547e294183896f5d9cd99","source_guid":"3fb2233e-6285-47e2-9418-3896f5d9cd99","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701905","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475602","_eventtype_color":"none","_indextime":"1753701608","_raw":"1753701605, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701605\", all_risk_objects=\"SRVI031.ad.ismett.it\", annotations.mitre_attack=\"T1021\", annotations.mitre_attack=\"T1021.001\", annotations.mitre_attack=\"T1021.003\", annotations.mitre_attack=\"T1021.006\", annotations.mitre_attack=\"T1035\", annotations.mitre_attack=\"T1047\", annotations.mitre_attack=\"T1053.005\", annotations.mitre_attack=\"T1055\", annotations.mitre_attack=\"T1059.001\", annotations.mitre_attack=\"T1102\", annotations.mitre_attack=\"T1175\", annotations.mitre_attack=\"T1218.014\", annotations.mitre_attack=\"T1485\", annotations.mitre_attack=\"T1489\", annotations.mitre_attack=\"T1543.003\", annotations.mitre_attack.mitre_tactic_id=\"TA0002\", annotations.mitre_attack.mitre_tactic_id=\"TA0003\", annotations.mitre_attack.mitre_tactic_id=\"TA0004\", annotations.mitre_attack.mitre_tactic_id=\"TA0005\", annotations.mitre_attack.mitre_tactic_id=\"TA0008\", annotations.mitre_attack.mitre_tactic_id=\"TA0011\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1021\", annotations.mitre_attack.mitre_technique_id=\"T1021.001\", annotations.mitre_attack.mitre_technique_id=\"T1021.003\", annotations.mitre_attack.mitre_technique_id=\"T1021.006\", annotations.mitre_attack.mitre_technique_id=\"T1035\", annotations.mitre_attack.mitre_technique_id=\"T1047\", annotations.mitre_attack.mitre_technique_id=\"T1053.005\", annotations.mitre_attack.mitre_technique_id=\"T1055\", annotations.mitre_attack.mitre_technique_id=\"T1059.001\", annotations.mitre_attack.mitre_technique_id=\"T1102\", annotations.mitre_attack.mitre_technique_id=\"T1175\", annotations.mitre_attack.mitre_technique_id=\"T1218.014\", annotations.mitre_attack.mitre_technique_id=\"T1485\", annotations.mitre_attack.mitre_technique_id=\"T1489\", annotations.mitre_attack.mitre_technique_id=\"T1543.003\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701000.000000000\", info_min_time=\"1753614600.000000000\", info_search_time=\"1753701601.512131000\", mitre_tactic_id_count=\"7\", mitre_technique_id_count=\"15\", normalized_risk_object=\"SRVI031.ad.ismett.it_ST91552\", orig_time=\"1753701605\", risk_event_count=\"6\", risk_object=\"SRVI031.ad.ismett.it\", risk_object_type=\"system\", risk_score=\"465900561885009700000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=SRVI031.ad.ismett.it\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - ESCU - Possible Lateral Movement PowerShell Spawn - Rule - Rule\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"2\", source_event_id=\"c0b030ca-1f6b-45b7-a7fb-c3bf04be9b70@@notable@@c0b030ca1f6b45b7a7fbc3bf04be9b70\", source_guid=\"c0b030ca-1f6b-45b7-a7fb-c3bf04be9b70\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"SRVI031.ad.ismett.it","_serial":"13","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:20:05.000+02:00","all_risk_objects":"SRVI031.ad.ismett.it","annotations.mitre_attack.mitre_description":["Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.\n\nIn an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. \n\nLegitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation: Kickstart Apple Remote Desktop commands)","Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n\nRemote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) \n\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)","Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.\n\nThe Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL)\n\nThrough DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). (Citation: MSDN WMI)","Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.\n\nWinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM  can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)","Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.","Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components.\n\nThe WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).(Citation: WMI 1-3) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Citation: Mandiant WMI)\n\nAn adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for [Discovery](https://attack.mitre.org/tactics/TA0007) as well as [Execution](https://attack.mitre.org/tactics/TA0002) of commands and payloads.(Citation: Mandiant WMI) For example, `wmic.exe` can be abused by an adversary to delete shadow copies with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490)).(Citation: WMI 6)\n\n**Note:** `wmic.exe` is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by [PowerShell](https://attack.mitre.org/techniques/T1059/001) as the primary WMI interface.(Citation: WMI 7,8) In addition to PowerShell and tools like `wbemtool.exe`, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.(Citation: WMI 7,8)","Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.(Citation: Stack Overflow) In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.(Citation: Red Canary - Atomic Red Team)\n\nAn adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)\n\nAdversaries may also create \"hidden\" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments) ","Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ","Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process<\/code> cmdlet which can be used to run an executable and the <code>Invoke-Command<\/code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363),  [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\n\nPowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe<\/code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation<\/code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)","Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).","**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.","Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt.(Citation: win_mmc)(Citation: what_is_mmc) MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration.(Citation: win_msc_files_overview)\n\nFor example, <code>mmc C:\\Users\\foo\\admintools.msc /a<\/code> will open a custom, saved console msc file in author mode.(Citation: win_mmc) Another common example is <code>mmc gpedit.msc<\/code>, which will open the Group Policy Editor application window. \n\nAdversaries may use MMC commands to perform malicious tasks. For example, <code>mmc wbadmin.msc delete catalog -quiet<\/code> deletes the backup catalog on the system (i.e. [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490)) without prompts to the user (Note: <code>wbadmin.msc<\/code> may only be present by default on Windows Server operating systems).(Citation: win_wbadmin_delete_catalog)(Citation: phobos_virustotal)\n\nAdversaries may also abuse MMC to execute malicious .msc files. For example, adversaries may first create a malicious registry Class Identifier (CLSID) subkey, which uniquely identifies a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) class object.(Citation: win_clsid_key) Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey.(Citation: mmc_vulns) Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: <code>mmc.exe -Embedding C:\\path\\to\\test.msc<\/code>.(Citation: abusing_com_reg)","Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del<\/code> and <code>rm<\/code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).\n\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ  - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.","Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS<\/code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)","Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.\n\nAdversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. \n\nAdversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as \"Bring Your Own Vulnerable Driver\" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020)\n\nServices may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002).\n\nTo make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create ‘hidden’ services (i.e., [Hide Artifacts](https://attack.mitre.org/techniques/T1564)), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.(Citation: SANS 1)(Citation: SANS 2)"],"annotations.mitre_attack.mitre_detection":["Correlate use of login activity related to remote services with unusual behavior or other malicious or suspicious activity. Adversaries will likely need to learn about an environment and the relationships between systems through Discovery techniques prior to attempting Lateral Movement. \n\nUse of applications such as ARD may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior using these applications. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time. \n\nIn macOS, you can review logs for \"screensharingd\" and \"Authentication\" event messages. Monitor network connections regarding remote management (ports tcp:3283 and tcp:5900) and for remote login (port tcp:22).(Citation: Lockboxx ARD 2019)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)","Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.","Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1059/001), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017) Monitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.\n\nMonitor for any influxes or abnormal increases in DCOM related Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic (typically over port 135).","Monitor use of WinRM within an environment by tracking service execution. If it is not normally used or is disabled, then this may be an indicator of suspicious behavior.  Monitor processes created and actions taken by the WinRM process or a WinRM invoked script to correlate it with other related events.(Citation: Medium Detecting Lateral Movement) Also monitor for remote WMI connection attempts (typically over port 5985 when using HTTP and 5986 for HTTPS).","Changes to service Registry entries and command-line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).","Monitor network traffic for WMI connections; the use of WMI in environments that do not typically use WMI may be suspect. Perform process monitoring to capture command-line arguments of \"wmic\" and detect commands that are used to perform remote behavior. (Citation: FireEye WMI 2015)","Monitor process execution from the <code>svchost.exe<\/code> in Windows 10 and the Windows Task Scheduler <code>taskeng.exe<\/code> for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\\System32\\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.\n\nConfigure event logging for scheduled task creation and changes by enabling the \"Microsoft-Windows-TaskScheduler/Operational\" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)\n\n* Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered\n* Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated\n* Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted\n* Event ID 4698 on Windows 10, Server 2016 - Scheduled task created\n* Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled\n* Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled\n\nTools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.","Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as <code>CreateRemoteThread<\/code>, <code>SuspendThread<\/code>/<code>SetThreadContext<\/code>/<code>ResumeThread<\/code>, <code>QueueUserAPC<\/code>/<code>NtQueueApcThread<\/code>, and those that can be used to modify memory within another process, such as <code>VirtualAllocEx<\/code>/<code>WriteProcessMemory<\/code>, may be used for this technique.(Citation: Elastic Process Injection July 2017) \n\nMonitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. \n\nMonitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)  (Citation: GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload rootkits) \n\nMonitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules.(Citation: Microsoft Sysmon v6 May 2017) \n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ","If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line. This change in policy on a system may be a way to detect malicious use of PowerShell. If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity.\n\nMonitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)\n\nIt is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations). (Citation: Malware Archaeology PowerShell Cheat Sheet) PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0. Earlier versions of PowerShell do not have many logging features.(Citation: FireEye PowerShell Logging 2016) An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data.\n\nConsider monitoring for Windows event ID (EID) 400, which shows the version of PowerShell executing in the <code>EngineVersion<\/code> field (which may also be relevant to detecting a potential [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)) as well as if PowerShell is running locally or remotely in the <code>HostName<\/code> field. Furthermore, EID 400 may indicate the start time and EID 403 indicates the end time of a PowerShell session.(Citation: inv_ps_attacks)","Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)","Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.\n\nMonitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.","Monitor processes and command-line parameters for suspicious or malicious use of MMC. Since MMC is a signed Windows binary, verify use of MMC is legitimate and not malicious. \n\nMonitor for creation and use of .msc files. MMC may legitimately be used to call Microsoft-created .msc files, such as <code>services.msc<\/code> or <code>eventvwr.msc<\/code>. Invoking non-Microsoft .msc files may be an indicator of malicious activity. ","Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under <code>C:\\Windows\\System32\\<\/code>.\n\nIn cloud environments, the occurrence of anomalous high-volume deletion events, such as the <code>DeleteDBCluster<\/code> and <code>DeleteGlobalCluster<\/code> events in AWS, or a high quantity of data deletion events, such as <code>DeleteBucket<\/code>, within a short period of time may indicate suspicious activity.","Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\n\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code>. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\n\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, <code>ChangeServiceConfigW<\/code> may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)","Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment. Services may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data. Remote access tools with built-in features may also interact directly with the Windows API to perform these functions outside of typical system utilities. Collect service utility execution and service binary path arguments used for analysis. Service binary paths may even be changed to execute commands or scripts.  \n\nLook for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code>. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.(Citation: TechNet Autoruns)  \n\nCreation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software.\n\nSuspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement."],"annotations.mitre_attack.mitre_platform":["Linux","macOS","Windows","IaaS","ESXi","Windows","Windows","Windows","Windows","Windows","Windows","Linux","macOS","Windows","Windows","Linux","macOS","Windows","ESXi","Windows","Windows","Windows","IaaS","Linux","macOS","Containers","ESXi","Windows","Linux","macOS","ESXi","Windows"],"annotations.mitre_attack.mitre_tactic":["lateral-movement","lateral-movement","lateral-movement","lateral-movement","execution","execution","execution","persistence","privilege-escalation","defense-evasion","privilege-escalation","execution","command-and-control","lateral-movement","execution","defense-evasion","impact","impact","persistence","privilege-escalation"],"annotations.mitre_attack.mitre_tactic_id":["TA0002","TA0003","TA0004","TA0005","TA0008","TA0011","TA0040"],"annotations.mitre_attack.mitre_technique":["Remote Services","Remote Desktop Protocol","Distributed Component Object Model","Windows Remote Management","Service Execution","Windows Management Instrumentation","Scheduled Task","Process Injection","PowerShell","Web Service","Component Object Model and Distributed COM","MMC","Data Destruction","Service Stop","Windows Service"],"annotations.mitre_attack.mitre_technique_id":["T1021","T1021.001","T1021.003","T1021.006","T1035","T1047","T1053.005","T1055","T1059.001","T1102","T1175","T1218.014","T1485","T1489","T1543.003"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1021","https://attack.mitre.org/techniques/T1021/001","https://attack.mitre.org/techniques/T1021/003","https://attack.mitre.org/techniques/T1021/006","https://attack.mitre.org/techniques/T1035","https://attack.mitre.org/techniques/T1047","https://attack.mitre.org/techniques/T1053/005","https://attack.mitre.org/techniques/T1055","https://attack.mitre.org/techniques/T1059/001","https://attack.mitre.org/techniques/T1102","https://attack.mitre.org/techniques/T1175","https://attack.mitre.org/techniques/T1218/014","https://attack.mitre.org/techniques/T1485","https://attack.mitre.org/techniques/T1489","https://attack.mitre.org/techniques/T1543/003"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"20","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614600.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701000.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"c0b030ca-1f6b-45b7-a7fb-c3bf04be9b70@@notable@@c0b030ca1f6b45b7a7fbc3bf04be9b70","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-02","index":"notable","info_max_time":"1753701000.000000000","info_min_time":"1753614600.000000000","info_search_time":"1753701601.512131000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"7","mitre_technique_id_count":"15","normalized_risk_object":"SRVI031.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"4","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=SRVI031.ad.ismett.it","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701600_1719_D34CA89D-17B5-4F96-AFF9-467186286F97","orig_source":["Threat - FW - ESCU - Possible Lateral Movement PowerShell Spawn - Rule - Rule","Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule"],"orig_tag":["ST91552","modaction_result"],"orig_time":"1753701605","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"6","risk_object":"SRVI031.ad.ismett.it","risk_object_type":"system","risk_score":"465900561885009700000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"c0b030ca-1f6b-45b7-a7fb-c3bf04be9b70@@notable@@c0b030ca1f6b45b7a7fbc3bf04be9b70","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"2","source_event_id":"c0b030ca-1f6b-45b7-a7fb-c3bf04be9b70@@notable@@c0b030ca1f6b45b7a7fbc3bf04be9b70","source_guid":"c0b030ca-1f6b-45b7-a7fb-c3bf04be9b70","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701605","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475561","_eventtype_color":"none","_indextime":"1753701605","_raw":"1753701605, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701605\", all_risk_objects=\"87.121.84.34\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701000.000000000\", info_min_time=\"1753614600.000000000\", info_search_time=\"1753701601.512131000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"87.121.84.34_ST91552\", orig_time=\"1753701605\", risk_event_count=\"3\", risk_object=\"87.121.84.34\", risk_object_type=\"system\", risk_score=\"11015759388655800\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=87.121.84.34\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"cefd7c55-17ca-4209-92a3-78152e924191@@notable@@cefd7c5517ca420992a378152e924191\", source_guid=\"cefd7c55-17ca-4209-92a3-78152e924191\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"87.121.84.34","_serial":"14","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:20:05.000+02:00","all_risk_objects":"87.121.84.34","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"20","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614600.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701000.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"cefd7c55-17ca-4209-92a3-78152e924191@@notable@@cefd7c5517ca420992a378152e924191","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-02","index":"notable","info_max_time":"1753701000.000000000","info_min_time":"1753614600.000000000","info_search_time":"1753701601.512131000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"87.121.84.34_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"3","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=87.121.84.34","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701600_1719_D34CA89D-17B5-4F96-AFF9-467186286F97","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701605","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"87.121.84.34","risk_object_type":"system","risk_score":"11015759388655800","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"cefd7c55-17ca-4209-92a3-78152e924191@@notable@@cefd7c5517ca420992a378152e924191","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"cefd7c55-17ca-4209-92a3-78152e924191@@notable@@cefd7c5517ca420992a378152e924191","source_guid":"cefd7c55-17ca-4209-92a3-78152e924191","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701605","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475505","_eventtype_color":"none","_indextime":"1753701605","_raw":"1753701605, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701605\", all_risk_objects=\"192.168.182.61\", annotations.mitre_attack=\"None\", annotations.mitre_attack=\"T1110\", annotations.mitre_attack=\"T1201\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_tactic_id=\"TA0006\", annotations.mitre_attack.mitre_tactic_id=\"TA0007\", annotations.mitre_attack.mitre_technique_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"T1110\", annotations.mitre_attack.mitre_technique_id=\"T1201\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701000.000000000\", info_min_time=\"1753614600.000000000\", info_search_time=\"1753701601.512131000\", mitre_tactic_id_count=\"3\", mitre_technique_id_count=\"3\", normalized_risk_object=\"192.168.182.61_ST91552\", orig_time=\"1753701605\", risk_event_count=\"8\", risk_object=\"192.168.182.61\", risk_object_type=\"system\", risk_score=\"3680\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=192.168.182.61\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Access - FW - Brute Force Access Behavior Detected - Rule\", orig_source=\"Access - FW - Brute Force Access Behavior Detected Over One Day - Rule\", orig_source=\"Access - FW - Excessive Failed Logins  - Rule\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"4\", source_event_id=\"503ace80-b8e4-4b6e-97c5-957eca3ea42f@@notable@@503ace80b8e44b6e97c5957eca3ea42f\", source_guid=\"503ace80-b8e4-4b6e-97c5-957eca3ea42f\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"192.168.182.61","_serial":"15","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:20:05.000+02:00","all_risk_objects":"192.168.182.61","annotations.mitre_attack.mitre_description":["Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.","Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)<\/code>, <code>Get-ADDefaultDomainPasswordPolicy<\/code>, <code>chage -l <username><\/code>, <code>cat /etc/pam.d/common-password<\/code>, and <code>pwpolicy getaccountpolicies<\/code> (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. <code>show aaa<\/code>, <code>show aaa common-criteria policy all<\/code>).(Citation: US-CERT-TA18-106A)\n\nPassword policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy<\/code> in AWS (Citation: AWS GetPasswordPolicy)."],"annotations.mitre_attack.mitre_detection":["Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.","Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity."],"annotations.mitre_attack.mitre_platform":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider","ESXi","Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"annotations.mitre_attack.mitre_tactic":["credential-access","discovery"],"annotations.mitre_attack.mitre_tactic_id":["None","TA0006","TA0007"],"annotations.mitre_attack.mitre_technique":["Brute Force","Password Policy Discovery"],"annotations.mitre_attack.mitre_technique_id":["None","T1110","T1201"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1110","https://attack.mitre.org/techniques/T1201"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"20","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614600.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701000.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"503ace80-b8e4-4b6e-97c5-957eca3ea42f@@notable@@503ace80b8e44b6e97c5957eca3ea42f","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-02","index":"notable","info_max_time":"1753701000.000000000","info_min_time":"1753614600.000000000","info_search_time":"1753701601.512131000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"3","mitre_technique_id_count":"3","normalized_risk_object":"192.168.182.61_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"2","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=192.168.182.61","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701600_1719_D34CA89D-17B5-4F96-AFF9-467186286F97","orig_source":["Access - FW - Brute Force Access Behavior Detected - Rule","Access - FW - Brute Force Access Behavior Detected Over One Day - Rule","Access - FW - Excessive Failed Logins  - Rule","Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule"],"orig_tag":["ST91552","modaction_result"],"orig_time":"1753701605","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"8","risk_object":"192.168.182.61","risk_object_type":"system","risk_score":"3680","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"503ace80-b8e4-4b6e-97c5-957eca3ea42f@@notable@@503ace80b8e44b6e97c5957eca3ea42f","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"4","source_event_id":"503ace80-b8e4-4b6e-97c5-957eca3ea42f@@notable@@503ace80b8e44b6e97c5957eca3ea42f","source_guid":"503ace80-b8e4-4b6e-97c5-957eca3ea42f","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701605","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475449","_eventtype_color":"none","_indextime":"1753701605","_raw":"1753701605, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701605\", all_risk_objects=\"192.168.182.42\", annotations.mitre_attack=\"None\", annotations.mitre_attack=\"T1110\", annotations.mitre_attack=\"T1201\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_tactic_id=\"TA0006\", annotations.mitre_attack.mitre_tactic_id=\"TA0007\", annotations.mitre_attack.mitre_technique_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"T1110\", annotations.mitre_attack.mitre_technique_id=\"T1201\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701000.000000000\", info_min_time=\"1753614600.000000000\", info_search_time=\"1753701601.512131000\", mitre_tactic_id_count=\"3\", mitre_technique_id_count=\"3\", normalized_risk_object=\"192.168.182.42_ST91552\", orig_time=\"1753701605\", risk_event_count=\"7\", risk_object=\"192.168.182.42\", risk_object_type=\"system\", risk_score=\"2560\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=192.168.182.42\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Access - FW - Brute Force Access Behavior Detected - Rule\", orig_source=\"Access - FW - Brute Force Access Behavior Detected Over One Day - Rule\", orig_source=\"Access - FW - Excessive Failed Logins  - Rule\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"4\", source_event_id=\"8813f4df-bd11-4490-9b6b-a7524c0e177f@@notable@@8813f4dfbd1144909b6ba7524c0e177f\", source_guid=\"8813f4df-bd11-4490-9b6b-a7524c0e177f\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"192.168.182.42","_serial":"16","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:20:05.000+02:00","all_risk_objects":"192.168.182.42","annotations.mitre_attack.mitre_description":["Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.","Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)<\/code>, <code>Get-ADDefaultDomainPasswordPolicy<\/code>, <code>chage -l <username><\/code>, <code>cat /etc/pam.d/common-password<\/code>, and <code>pwpolicy getaccountpolicies<\/code> (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. <code>show aaa<\/code>, <code>show aaa common-criteria policy all<\/code>).(Citation: US-CERT-TA18-106A)\n\nPassword policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy<\/code> in AWS (Citation: AWS GetPasswordPolicy)."],"annotations.mitre_attack.mitre_detection":["Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.","Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity."],"annotations.mitre_attack.mitre_platform":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider","ESXi","Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"annotations.mitre_attack.mitre_tactic":["credential-access","discovery"],"annotations.mitre_attack.mitre_tactic_id":["None","TA0006","TA0007"],"annotations.mitre_attack.mitre_technique":["Brute Force","Password Policy Discovery"],"annotations.mitre_attack.mitre_technique_id":["None","T1110","T1201"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1110","https://attack.mitre.org/techniques/T1201"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"20","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614600.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701000.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"8813f4df-bd11-4490-9b6b-a7524c0e177f@@notable@@8813f4dfbd1144909b6ba7524c0e177f","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-02","index":"notable","info_max_time":"1753701000.000000000","info_min_time":"1753614600.000000000","info_search_time":"1753701601.512131000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"3","mitre_technique_id_count":"3","normalized_risk_object":"192.168.182.42_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"1","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=192.168.182.42","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701600_1719_D34CA89D-17B5-4F96-AFF9-467186286F97","orig_source":["Access - FW - Brute Force Access Behavior Detected - Rule","Access - FW - Brute Force Access Behavior Detected Over One Day - Rule","Access - FW - Excessive Failed Logins  - Rule","Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule"],"orig_tag":["ST91552","modaction_result"],"orig_time":"1753701605","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"7","risk_object":"192.168.182.42","risk_object_type":"system","risk_score":"2560","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"8813f4df-bd11-4490-9b6b-a7524c0e177f@@notable@@8813f4dfbd1144909b6ba7524c0e177f","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"4","source_event_id":"8813f4df-bd11-4490-9b6b-a7524c0e177f@@notable@@8813f4dfbd1144909b6ba7524c0e177f","source_guid":"8813f4df-bd11-4490-9b6b-a7524c0e177f","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701605","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475408","_eventtype_color":"none","_indextime":"1753701605","_raw":"1753701605, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701605\", all_risk_objects=\"167.94.146.49\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753701000.000000000\", info_min_time=\"1753614600.000000000\", info_search_time=\"1753701601.512131000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"167.94.146.49_ST91552\", orig_time=\"1753701605\", risk_event_count=\"3\", risk_object=\"167.94.146.49\", risk_object_type=\"system\", risk_score=\"6085869279690280000000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=167.94.146.49\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"25cea785-de4a-4c91-b38c-51a0af52f68a@@notable@@25cea785de4a4c91b38c51a0af52f68a\", source_guid=\"25cea785-de4a-4c91-b38c-51a0af52f68a\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"167.94.146.49","_serial":"17","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:20:05.000+02:00","all_risk_objects":"167.94.146.49","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"20","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614600.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753701000.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"25cea785-de4a-4c91-b38c-51a0af52f68a@@notable@@25cea785de4a4c91b38c51a0af52f68a","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-02","index":"notable","info_max_time":"1753701000.000000000","info_min_time":"1753614600.000000000","info_search_time":"1753701601.512131000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"167.94.146.49_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"0","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=167.94.146.49","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701600_1719_D34CA89D-17B5-4F96-AFF9-467186286F97","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701605","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"167.94.146.49","risk_object_type":"system","risk_score":"6085869279690280000000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"25cea785-de4a-4c91-b38c-51a0af52f68a@@notable@@25cea785de4a4c91b38c51a0af52f68a","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"25cea785-de4a-4c91-b38c-51a0af52f68a@@notable@@25cea785de4a4c91b38c51a0af52f68a","source_guid":"25cea785-de4a-4c91-b38c-51a0af52f68a","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701605","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475333","_eventtype_color":"none","_indextime":"1753701008","_raw":"1753701005, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701005\", all_risk_objects=\"IPAVDGE2.ad.ismett.it\", annotations.mitre_attack=\"T1035\", annotations.mitre_attack=\"T1055\", annotations.mitre_attack=\"T1102\", annotations.mitre_attack=\"T1175\", annotations.mitre_attack=\"T1485\", annotations.mitre_attack=\"T1489\", annotations.mitre_attack=\"T1499\", annotations.mitre_attack.mitre_tactic_id=\"TA0002\", annotations.mitre_attack.mitre_tactic_id=\"TA0004\", annotations.mitre_attack.mitre_tactic_id=\"TA0005\", annotations.mitre_attack.mitre_tactic_id=\"TA0008\", annotations.mitre_attack.mitre_tactic_id=\"TA0011\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1035\", annotations.mitre_attack.mitre_technique_id=\"T1055\", annotations.mitre_attack.mitre_technique_id=\"T1102\", annotations.mitre_attack.mitre_technique_id=\"T1175\", annotations.mitre_attack.mitre_technique_id=\"T1485\", annotations.mitre_attack.mitre_technique_id=\"T1489\", annotations.mitre_attack.mitre_technique_id=\"T1499\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753700400.000000000\", info_min_time=\"1753614000.000000000\", info_search_time=\"1753701001.952445000\", mitre_tactic_id_count=\"6\", mitre_technique_id_count=\"7\", normalized_risk_object=\"ipavdge2.ad.ismett.it_ST91552\", orig_time=\"1753701005\", risk_event_count=\"3\", risk_object=\"IPAVDGE2.ad.ismett.it\", risk_object_type=\"system\", risk_score=\"2411087573540539300000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=IPAVDGE2.ad.ismett.it\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"cc6cc27b-fd80-4aec-8a13-55360c2cf173@@notable@@cc6cc27bfd804aec8a1355360c2cf173\", source_guid=\"cc6cc27b-fd80-4aec-8a13-55360c2cf173\", orig_tag=\"ST91552\", orig_tag=\"expected\", orig_tag=\"microsoft\", orig_tag=\"modaction_result\", orig_tag=\"produzione\", orig_tag=\"terminal server\"","_risk_system":"IPAVDGE2.ad.ismett.it","_serial":"18","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:10:05.000+02:00","all_risk_objects":"IPAVDGE2.ad.ismett.it","annotations.mitre_attack.mitre_description":["Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.","Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ","Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).","**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.","Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del<\/code> and <code>rm<\/code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).\n\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ  - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.","Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS<\/code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)","Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nAn Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nBotnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)\n\nIn cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)\n\nFor attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).\n"],"annotations.mitre_attack.mitre_detection":["Changes to service Registry entries and command-line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).","Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as <code>CreateRemoteThread<\/code>, <code>SuspendThread<\/code>/<code>SetThreadContext<\/code>/<code>ResumeThread<\/code>, <code>QueueUserAPC<\/code>/<code>NtQueueApcThread<\/code>, and those that can be used to modify memory within another process, such as <code>VirtualAllocEx<\/code>/<code>WriteProcessMemory<\/code>, may be used for this technique.(Citation: Elastic Process Injection July 2017) \n\nMonitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. \n\nMonitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)  (Citation: GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload rootkits) \n\nMonitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules.(Citation: Microsoft Sysmon v6 May 2017) \n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ","Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)","Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.\n\nMonitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.","Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under <code>C:\\Windows\\System32\\<\/code>.\n\nIn cloud environments, the occurrence of anomalous high-volume deletion events, such as the <code>DeleteDBCluster<\/code> and <code>DeleteGlobalCluster<\/code> events in AWS, or a high quantity of data deletion events, such as <code>DeleteBucket<\/code>, within a short period of time may indicate suspicious activity.","Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\n\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code>. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\n\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, <code>ChangeServiceConfigW<\/code> may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)","Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.\n\nIn addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.\n\nExternally monitor the availability of services that may be targeted by an Endpoint DoS."],"annotations.mitre_attack.mitre_platform":["Windows","Linux","macOS","Windows","Linux","macOS","Windows","ESXi","Windows","Windows","IaaS","Linux","macOS","Containers","ESXi","Windows","Linux","macOS","ESXi","Windows","Linux","macOS","Containers","IaaS"],"annotations.mitre_attack.mitre_tactic":["execution","defense-evasion","privilege-escalation","command-and-control","lateral-movement","execution","impact","impact","impact"],"annotations.mitre_attack.mitre_tactic_id":["TA0002","TA0004","TA0005","TA0008","TA0011","TA0040"],"annotations.mitre_attack.mitre_technique":["Service Execution","Process Injection","Web Service","Component Object Model and Distributed COM","Data Destruction","Service Stop","Endpoint Denial of Service"],"annotations.mitre_attack.mitre_technique_id":["T1035","T1055","T1102","T1175","T1485","T1489","T1499"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1035","https://attack.mitre.org/techniques/T1055","https://attack.mitre.org/techniques/T1102","https://attack.mitre.org/techniques/T1175","https://attack.mitre.org/techniques/T1485","https://attack.mitre.org/techniques/T1489","https://attack.mitre.org/techniques/T1499"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"10","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614000.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753700400.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"cc6cc27b-fd80-4aec-8a13-55360c2cf173@@notable@@cc6cc27bfd804aec8a1355360c2cf173","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753700400.000000000","info_min_time":"1753614000.000000000","info_search_time":"1753701001.952445000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"6","mitre_technique_id_count":"7","normalized_risk_object":"ipavdge2.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"4","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=IPAVDGE2.ad.ismett.it","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701000_1649_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","expected","microsoft","modaction_result","produzione","terminal server"],"orig_time":"1753701005","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"IPAVDGE2.ad.ismett.it","risk_object_asset":["ipavdge2.ad.ismett.it","192.168.9.79","172.20.30.242","ipavdge2"],"risk_object_asset_id":"647f43521ec6904877781b5e","risk_object_asset_tag":["microsoft","produzione","terminal server","expected"],"risk_object_category":["microsoft","produzione","terminal server"],"risk_object_dns":"ipavdge2.ad.ismett.it","risk_object_domain":"aditismett","risk_object_ip":["192.168.9.79","172.20.30.242"],"risk_object_is_expected":"true","risk_object_notes":"ismett-ge-virtual machine-test usati come client da ge per configurazione","risk_object_nt_host":"ipavdge2","risk_object_os_version":"windows server 2016 standard edition (x64)","risk_object_pci_domain":"untrust","risk_object_priority":"high","risk_object_type":"system","risk_score":"2411087573540539300000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"cc6cc27b-fd80-4aec-8a13-55360c2cf173@@notable@@cc6cc27bfd804aec8a1355360c2cf173","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"cc6cc27b-fd80-4aec-8a13-55360c2cf173@@notable@@cc6cc27bfd804aec8a1355360c2cf173","source_guid":"cc6cc27b-fd80-4aec-8a13-55360c2cf173","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista","expected","microsoft","produzione","terminal server"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701005","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475269","_eventtype_color":"none","_indextime":"1753701005","_raw":"1753701005, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701005\", all_risk_objects=\"SRVTS01SHB.ad.ismett.it\", annotations.mitre_attack=\"T1021.001\", annotations.mitre_attack=\"T1035\", annotations.mitre_attack=\"T1055\", annotations.mitre_attack=\"T1102\", annotations.mitre_attack=\"T1175\", annotations.mitre_attack=\"T1489\", annotations.mitre_attack.mitre_tactic_id=\"TA0002\", annotations.mitre_attack.mitre_tactic_id=\"TA0004\", annotations.mitre_attack.mitre_tactic_id=\"TA0005\", annotations.mitre_attack.mitre_tactic_id=\"TA0008\", annotations.mitre_attack.mitre_tactic_id=\"TA0011\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1021.001\", annotations.mitre_attack.mitre_technique_id=\"T1035\", annotations.mitre_attack.mitre_technique_id=\"T1055\", annotations.mitre_attack.mitre_technique_id=\"T1102\", annotations.mitre_attack.mitre_technique_id=\"T1175\", annotations.mitre_attack.mitre_technique_id=\"T1489\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753700400.000000000\", info_min_time=\"1753614000.000000000\", info_search_time=\"1753701001.952445000\", mitre_tactic_id_count=\"6\", mitre_technique_id_count=\"6\", normalized_risk_object=\"SRVTS01SHB.ad.ismett.it_ST91552\", orig_time=\"1753701005\", risk_event_count=\"3\", risk_object=\"SRVTS01SHB.ad.ismett.it\", risk_object_type=\"system\", risk_score=\"61995537985230\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=SRVTS01SHB.ad.ismett.it\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"f0e4093b-aee8-4c4a-b134-8b887412c7fb@@notable@@f0e4093baee84c4ab1348b887412c7fb\", source_guid=\"f0e4093b-aee8-4c4a-b134-8b887412c7fb\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"SRVTS01SHB.ad.ismett.it","_serial":"19","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:10:05.000+02:00","all_risk_objects":"SRVTS01SHB.ad.ismett.it","annotations.mitre_attack.mitre_description":["Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n\nRemote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) \n\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)","Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.","Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ","Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).","**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.","Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS<\/code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)"],"annotations.mitre_attack.mitre_detection":["Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.","Changes to service Registry entries and command-line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).","Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as <code>CreateRemoteThread<\/code>, <code>SuspendThread<\/code>/<code>SetThreadContext<\/code>/<code>ResumeThread<\/code>, <code>QueueUserAPC<\/code>/<code>NtQueueApcThread<\/code>, and those that can be used to modify memory within another process, such as <code>VirtualAllocEx<\/code>/<code>WriteProcessMemory<\/code>, may be used for this technique.(Citation: Elastic Process Injection July 2017) \n\nMonitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. \n\nMonitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)  (Citation: GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload rootkits) \n\nMonitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules.(Citation: Microsoft Sysmon v6 May 2017) \n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ","Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)","Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.\n\nMonitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.","Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\n\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code>. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\n\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, <code>ChangeServiceConfigW<\/code> may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)"],"annotations.mitre_attack.mitre_platform":["Windows","Windows","Linux","macOS","Windows","Linux","macOS","Windows","ESXi","Windows","Windows","Linux","macOS","ESXi"],"annotations.mitre_attack.mitre_tactic":["lateral-movement","execution","defense-evasion","privilege-escalation","command-and-control","lateral-movement","execution","impact"],"annotations.mitre_attack.mitre_tactic_id":["TA0002","TA0004","TA0005","TA0008","TA0011","TA0040"],"annotations.mitre_attack.mitre_technique":["Remote Desktop Protocol","Service Execution","Process Injection","Web Service","Component Object Model and Distributed COM","Service Stop"],"annotations.mitre_attack.mitre_technique_id":["T1021.001","T1035","T1055","T1102","T1175","T1489"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1021/001","https://attack.mitre.org/techniques/T1035","https://attack.mitre.org/techniques/T1055","https://attack.mitre.org/techniques/T1102","https://attack.mitre.org/techniques/T1175","https://attack.mitre.org/techniques/T1489"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"10","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614000.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753700400.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"f0e4093b-aee8-4c4a-b134-8b887412c7fb@@notable@@f0e4093baee84c4ab1348b887412c7fb","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753700400.000000000","info_min_time":"1753614000.000000000","info_search_time":"1753701001.952445000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"6","mitre_technique_id_count":"6","normalized_risk_object":"SRVTS01SHB.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"3","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=SRVTS01SHB.ad.ismett.it","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701000_1649_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701005","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"SRVTS01SHB.ad.ismett.it","risk_object_type":"system","risk_score":"61995537985230","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"f0e4093b-aee8-4c4a-b134-8b887412c7fb@@notable@@f0e4093baee84c4ab1348b887412c7fb","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"f0e4093b-aee8-4c4a-b134-8b887412c7fb@@notable@@f0e4093baee84c4ab1348b887412c7fb","source_guid":"f0e4093b-aee8-4c4a-b134-8b887412c7fb","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701005","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475205","_eventtype_color":"none","_indextime":"1753701005","_raw":"1753701005, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701005\", all_risk_objects=\"SRVTS01SHA.ad.ismett.it\", annotations.mitre_attack=\"T1021.001\", annotations.mitre_attack=\"T1035\", annotations.mitre_attack=\"T1055\", annotations.mitre_attack=\"T1102\", annotations.mitre_attack=\"T1175\", annotations.mitre_attack=\"T1489\", annotations.mitre_attack.mitre_tactic_id=\"TA0002\", annotations.mitre_attack.mitre_tactic_id=\"TA0004\", annotations.mitre_attack.mitre_tactic_id=\"TA0005\", annotations.mitre_attack.mitre_tactic_id=\"TA0008\", annotations.mitre_attack.mitre_tactic_id=\"TA0011\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1021.001\", annotations.mitre_attack.mitre_technique_id=\"T1035\", annotations.mitre_attack.mitre_technique_id=\"T1055\", annotations.mitre_attack.mitre_technique_id=\"T1102\", annotations.mitre_attack.mitre_technique_id=\"T1175\", annotations.mitre_attack.mitre_technique_id=\"T1489\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753700400.000000000\", info_min_time=\"1753614000.000000000\", info_search_time=\"1753701001.952445000\", mitre_tactic_id_count=\"6\", mitre_technique_id_count=\"6\", normalized_risk_object=\"SRVTS01SHA.ad.ismett.it_ST91552\", orig_time=\"1753701005\", risk_event_count=\"3\", risk_object=\"SRVTS01SHA.ad.ismett.it\", risk_object_type=\"system\", risk_score=\"61995537985230\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=SRVTS01SHA.ad.ismett.it\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"4b7aa161-2c11-4991-856e-7ca78639ed3a@@notable@@4b7aa1612c114991856e7ca78639ed3a\", source_guid=\"4b7aa161-2c11-4991-856e-7ca78639ed3a\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"SRVTS01SHA.ad.ismett.it","_serial":"20","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:10:05.000+02:00","all_risk_objects":"SRVTS01SHA.ad.ismett.it","annotations.mitre_attack.mitre_description":["Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n\nRemote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) \n\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)","Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.","Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ","Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).","**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.","Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS<\/code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)"],"annotations.mitre_attack.mitre_detection":["Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.","Changes to service Registry entries and command-line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).","Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as <code>CreateRemoteThread<\/code>, <code>SuspendThread<\/code>/<code>SetThreadContext<\/code>/<code>ResumeThread<\/code>, <code>QueueUserAPC<\/code>/<code>NtQueueApcThread<\/code>, and those that can be used to modify memory within another process, such as <code>VirtualAllocEx<\/code>/<code>WriteProcessMemory<\/code>, may be used for this technique.(Citation: Elastic Process Injection July 2017) \n\nMonitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. \n\nMonitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)  (Citation: GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload rootkits) \n\nMonitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules.(Citation: Microsoft Sysmon v6 May 2017) \n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ","Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)","Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.\n\nMonitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.","Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\n\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code>. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\n\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, <code>ChangeServiceConfigW<\/code> may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)"],"annotations.mitre_attack.mitre_platform":["Windows","Windows","Linux","macOS","Windows","Linux","macOS","Windows","ESXi","Windows","Windows","Linux","macOS","ESXi"],"annotations.mitre_attack.mitre_tactic":["lateral-movement","execution","defense-evasion","privilege-escalation","command-and-control","lateral-movement","execution","impact"],"annotations.mitre_attack.mitre_tactic_id":["TA0002","TA0004","TA0005","TA0008","TA0011","TA0040"],"annotations.mitre_attack.mitre_technique":["Remote Desktop Protocol","Service Execution","Process Injection","Web Service","Component Object Model and Distributed COM","Service Stop"],"annotations.mitre_attack.mitre_technique_id":["T1021.001","T1035","T1055","T1102","T1175","T1489"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1021/001","https://attack.mitre.org/techniques/T1035","https://attack.mitre.org/techniques/T1055","https://attack.mitre.org/techniques/T1102","https://attack.mitre.org/techniques/T1175","https://attack.mitre.org/techniques/T1489"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"10","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614000.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753700400.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"4b7aa161-2c11-4991-856e-7ca78639ed3a@@notable@@4b7aa1612c114991856e7ca78639ed3a","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753700400.000000000","info_min_time":"1753614000.000000000","info_search_time":"1753701001.952445000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"6","mitre_technique_id_count":"6","normalized_risk_object":"SRVTS01SHA.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"2","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=SRVTS01SHA.ad.ismett.it","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701000_1649_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701005","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"SRVTS01SHA.ad.ismett.it","risk_object_type":"system","risk_score":"61995537985230","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"4b7aa161-2c11-4991-856e-7ca78639ed3a@@notable@@4b7aa1612c114991856e7ca78639ed3a","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"4b7aa161-2c11-4991-856e-7ca78639ed3a@@notable@@4b7aa1612c114991856e7ca78639ed3a","source_guid":"4b7aa161-2c11-4991-856e-7ca78639ed3a","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701005","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475138","_eventtype_color":"none","_indextime":"1753701005","_raw":"1753701005, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701005\", all_risk_objects=\"SRVTS01CB.ad.ismett.it\", annotations.mitre_attack=\"T1021.001\", annotations.mitre_attack=\"T1035\", annotations.mitre_attack=\"T1055\", annotations.mitre_attack=\"T1102\", annotations.mitre_attack=\"T1175\", annotations.mitre_attack=\"T1485\", annotations.mitre_attack=\"T1489\", annotations.mitre_attack.mitre_tactic_id=\"TA0002\", annotations.mitre_attack.mitre_tactic_id=\"TA0004\", annotations.mitre_attack.mitre_tactic_id=\"TA0005\", annotations.mitre_attack.mitre_tactic_id=\"TA0008\", annotations.mitre_attack.mitre_tactic_id=\"TA0011\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1021.001\", annotations.mitre_attack.mitre_technique_id=\"T1035\", annotations.mitre_attack.mitre_technique_id=\"T1055\", annotations.mitre_attack.mitre_technique_id=\"T1102\", annotations.mitre_attack.mitre_technique_id=\"T1175\", annotations.mitre_attack.mitre_technique_id=\"T1485\", annotations.mitre_attack.mitre_technique_id=\"T1489\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753700400.000000000\", info_min_time=\"1753614000.000000000\", info_search_time=\"1753701001.952445000\", mitre_tactic_id_count=\"6\", mitre_technique_id_count=\"7\", normalized_risk_object=\"SRVTS01CB.ad.ismett.it_ST91552\", orig_time=\"1753701005\", risk_event_count=\"3\", risk_object=\"SRVTS01CB.ad.ismett.it\", risk_object_type=\"system\", risk_score=\"5654202969866478\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=SRVTS01CB.ad.ismett.it\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"67c262a4-502f-4c3c-a5cb-e36cf7adc96c@@notable@@67c262a4502f4c3ca5cbe36cf7adc96c\", source_guid=\"67c262a4-502f-4c3c-a5cb-e36cf7adc96c\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"SRVTS01CB.ad.ismett.it","_serial":"21","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:10:05.000+02:00","all_risk_objects":"SRVTS01CB.ad.ismett.it","annotations.mitre_attack.mitre_description":["Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n\nRemote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) \n\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)","Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.","Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ","Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).","**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**\n\nAdversaries may use the Windows Component Object Model (COM) and Distributed Component Object Model (DCOM) for local code execution or to execute on remote systems as part of lateral movement. \n\nCOM is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) DCOM is transparent middleware that extends the functionality of Component Object Model (COM) (Citation: Microsoft COM) beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. (Citation: Microsoft COM ACL)(Citation: Microsoft Process Wide Com Keys)(Citation: Microsoft System Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.\n\nAdversaries may abuse COM for local command and/or payload execution. Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and VBScript.(Citation: Microsoft COM) Specific COM objects also exists to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors such as Privilege Escalation and Persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)\n\nAdversaries may use DCOM for lateral movement. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications (Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents (Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1173) (DDE) execution directly through a COM created instance of a Microsoft Office application (Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.","Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del<\/code> and <code>rm<\/code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).\n\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ  - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.","Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS<\/code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)"],"annotations.mitre_attack.mitre_detection":["Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.","Changes to service Registry entries and command-line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).","Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as <code>CreateRemoteThread<\/code>, <code>SuspendThread<\/code>/<code>SetThreadContext<\/code>/<code>ResumeThread<\/code>, <code>QueueUserAPC<\/code>/<code>NtQueueApcThread<\/code>, and those that can be used to modify memory within another process, such as <code>VirtualAllocEx<\/code>/<code>WriteProcessMemory<\/code>, may be used for this technique.(Citation: Elastic Process Injection July 2017) \n\nMonitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. \n\nMonitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)  (Citation: GNU Acct)  (Citation: RHEL auditd)  (Citation: Chokepoint preload rootkits) \n\nMonitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules.(Citation: Microsoft Sysmon v6 May 2017) \n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ","Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)","Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1086), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017)\n\nMonitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.\n\nMonitor for any influxes or abnormal increases in Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic.","Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under <code>C:\\Windows\\System32\\<\/code>.\n\nIn cloud environments, the occurrence of anomalous high-volume deletion events, such as the <code>DeleteDBCluster<\/code> and <code>DeleteGlobalCluster<\/code> events in AWS, or a high quantity of data deletion events, such as <code>DeleteBucket<\/code>, within a short period of time may indicate suspicious activity.","Monitor processes and command-line arguments to see if critical processes are terminated or stop running.\n\nMonitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at <code>HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code>. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.\n\nAlterations to the service binary path or the service startup type changed to disabled may be suspicious.\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, <code>ChangeServiceConfigW<\/code> may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)"],"annotations.mitre_attack.mitre_platform":["Windows","Windows","Linux","macOS","Windows","Linux","macOS","Windows","ESXi","Windows","Windows","IaaS","Linux","macOS","Containers","ESXi","Windows","Linux","macOS","ESXi"],"annotations.mitre_attack.mitre_tactic":["lateral-movement","execution","defense-evasion","privilege-escalation","command-and-control","lateral-movement","execution","impact","impact"],"annotations.mitre_attack.mitre_tactic_id":["TA0002","TA0004","TA0005","TA0008","TA0011","TA0040"],"annotations.mitre_attack.mitre_technique":["Remote Desktop Protocol","Service Execution","Process Injection","Web Service","Component Object Model and Distributed COM","Data Destruction","Service Stop"],"annotations.mitre_attack.mitre_technique_id":["T1021.001","T1035","T1055","T1102","T1175","T1485","T1489"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1021/001","https://attack.mitre.org/techniques/T1035","https://attack.mitre.org/techniques/T1055","https://attack.mitre.org/techniques/T1102","https://attack.mitre.org/techniques/T1175","https://attack.mitre.org/techniques/T1485","https://attack.mitre.org/techniques/T1489"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"10","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614000.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753700400.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"67c262a4-502f-4c3c-a5cb-e36cf7adc96c@@notable@@67c262a4502f4c3ca5cbe36cf7adc96c","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753700400.000000000","info_min_time":"1753614000.000000000","info_search_time":"1753701001.952445000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"6","mitre_technique_id_count":"7","normalized_risk_object":"SRVTS01CB.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"1","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=SRVTS01CB.ad.ismett.it","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701000_1649_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701005","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"SRVTS01CB.ad.ismett.it","risk_object_type":"system","risk_score":"5654202969866478","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"67c262a4-502f-4c3c-a5cb-e36cf7adc96c@@notable@@67c262a4502f4c3ca5cbe36cf7adc96c","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"67c262a4-502f-4c3c-a5cb-e36cf7adc96c@@notable@@67c262a4502f4c3ca5cbe36cf7adc96c","source_guid":"67c262a4-502f-4c3c-a5cb-e36cf7adc96c","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701005","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475098","_eventtype_color":"none","_indextime":"1753701005","_raw":"1753701005, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753701005\", all_risk_objects=\"172.18.4.129\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753700400.000000000\", info_min_time=\"1753614000.000000000\", info_search_time=\"1753701001.952445000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"172.18.4.129_ST91552\", orig_time=\"1753701005\", risk_event_count=\"3\", risk_object=\"172.18.4.129\", risk_object_type=\"system\", risk_score=\"6512280\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=172.18.4.129\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"fb58ab0a-ad53-4335-8a1b-1c2d99344bc3@@notable@@fb58ab0aad5343358a1b1c2d99344bc3\", source_guid=\"fb58ab0a-ad53-4335-8a1b-1c2d99344bc3\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"172.18.4.129","_serial":"22","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T13:10:05.000+02:00","all_risk_objects":"172.18.4.129","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"11","date_mday":"28","date_minute":"10","date_month":"july","date_second":"5","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753614000.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753700400.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"fb58ab0a-ad53-4335-8a1b-1c2d99344bc3@@notable@@fb58ab0aad5343358a1b1c2d99344bc3","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-01","index":"notable","info_max_time":"1753700400.000000000","info_min_time":"1753614000.000000000","info_search_time":"1753701001.952445000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"172.18.4.129_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"0","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=172.18.4.129","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753701000_1649_FFCD4169-B632-4FB5-9CEB-D6B3D1DD6C80","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753701005","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"172.18.4.129","risk_object_type":"system","risk_score":"6512280","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"fb58ab0a-ad53-4335-8a1b-1c2d99344bc3@@notable@@fb58ab0aad5343358a1b1c2d99344bc3","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"fb58ab0a-ad53-4335-8a1b-1c2d99344bc3@@notable@@fb58ab0aad5343358a1b1c2d99344bc3","source_guid":"fb58ab0a-ad53-4335-8a1b-1c2d99344bc3","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753701005","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~44~5D398647-642E-43D4-9788-5FB926D8AAF0","_cd":"44:423497","_eventtype_color":"none","_indextime":"1753699809","_raw":"1753699804, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753699804\", all_risk_objects=\"srva062.ad.ismett.it\", annotations.mitre_attack=\"T1499\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1499\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753699200.000000000\", info_min_time=\"1753612800.000000000\", info_search_time=\"1753699800.596903000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"srva062.ad.ismett.it_ST91552\", orig_time=\"1753699804\", risk_event_count=\"4\", risk_object=\"srva062.ad.ismett.it\", risk_object_type=\"system\", risk_score=\"931659070325296000000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=srva062.ad.ismett.it\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"55e603ed-88e1-4017-b374-47ac4aa164ad@@notable@@55e603ed88e14017b37447ac4aa164ad\", source_guid=\"55e603ed-88e1-4017-b374-47ac4aa164ad\", orig_tag=\"ST91552\", orig_tag=\"application\", orig_tag=\"expected\", orig_tag=\"linux\", orig_tag=\"modaction_result\", orig_tag=\"produzione\"","_risk_system":"srva062.ad.ismett.it","_serial":"0","_si":["FW-SIEM-INDEXER-02","notable"],"_sourcetype":"stash","_time":"2025-07-28T12:50:04.000+02:00","all_risk_objects":"srva062.ad.ismett.it","annotations.mitre_attack.mitre_description":"Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nAn Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nBotnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)\n\nIn cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)\n\nFor attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).\n","annotations.mitre_attack.mitre_detection":"Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.\n\nIn addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.\n\nExternally monitor the availability of services that may be targeted by an Endpoint DoS.","annotations.mitre_attack.mitre_platform":["Windows","Linux","macOS","Containers","IaaS"],"annotations.mitre_attack.mitre_tactic":"impact","annotations.mitre_attack.mitre_tactic_id":"TA0040","annotations.mitre_attack.mitre_technique":"Endpoint Denial of Service","annotations.mitre_attack.mitre_technique_id":"T1499","annotations.mitre_attack.mitre_url":"https://attack.mitre.org/techniques/T1499","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"10","date_mday":"28","date_minute":"50","date_month":"july","date_second":"4","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753612800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753699200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"55e603ed-88e1-4017-b374-47ac4aa164ad@@notable@@55e603ed88e14017b37447ac4aa164ad","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753699200.000000000","info_min_time":"1753612800.000000000","info_search_time":"1753699800.596903000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"srva062.ad.ismett.it_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"5","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=srva062.ad.ismett.it","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753699800_1461_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","application","expected","linux","modaction_result","produzione"],"orig_time":"1753699804","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"srva062.ad.ismett.it","risk_object_asset":["srva062.ad.ismett.it","172.20.30.62","srva062"],"risk_object_asset_id":"647f43521ec6904877781bc8","risk_object_asset_tag":["linux","produzione","application","expected"],"risk_object_category":["linux","produzione","application"],"risk_object_dns":"srva062.ad.ismett.it","risk_object_domain":"aditismett","risk_object_ip":"172.20.30.62","risk_object_is_expected":"true","risk_object_notes":"application server siemens","risk_object_nt_host":"srva062","risk_object_os_version":"ubuntu 20.04.6 lts (focal fossa)","risk_object_pci_domain":"untrust","risk_object_priority":"medium","risk_object_type":"system","risk_score":"931659070325296000000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"55e603ed-88e1-4017-b374-47ac4aa164ad@@notable@@55e603ed88e14017b37447ac4aa164ad","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"55e603ed-88e1-4017-b374-47ac4aa164ad@@notable@@55e603ed88e14017b37447ac4aa164ad","source_guid":"55e603ed-88e1-4017-b374-47ac4aa164ad","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-02","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista","application","expected","linux","produzione"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753699804","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~44~5D398647-642E-43D4-9788-5FB926D8AAF0","_cd":"44:423448","_eventtype_color":"none","_indextime":"1753699805","_raw":"1753699804, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753699804\", all_risk_objects=\"lferrante\", annotations.mitre_attack=\"T1078.002\", annotations.mitre_attack=\"T1078.003\", annotations.mitre_attack.mitre_tactic_id=\"TA0001\", annotations.mitre_attack.mitre_tactic_id=\"TA0003\", annotations.mitre_attack.mitre_tactic_id=\"TA0004\", annotations.mitre_attack.mitre_tactic_id=\"TA0005\", annotations.mitre_attack.mitre_technique_id=\"T1078.002\", annotations.mitre_attack.mitre_technique_id=\"T1078.003\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753699200.000000000\", info_min_time=\"1753612800.000000000\", info_search_time=\"1753699800.596903000\", mitre_tactic_id_count=\"4\", mitre_technique_id_count=\"2\", normalized_risk_object=\"lferrante_ST91552\", orig_time=\"1753699804\", risk_event_count=\"4\", risk_object=\"lferrante\", risk_object_type=\"user\", risk_score=\"6033418404304953000000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for user=lferrante\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"a821b444-cb4f-4de3-b1a0-a88a4b55c7df@@notable@@a821b444cb4f4de3b1a0a88a4b55c7df\", source_guid=\"a821b444-cb4f-4de3-b1a0-a88a4b55c7df\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_user":"lferrante","_serial":"1","_si":["FW-SIEM-INDEXER-02","notable"],"_sourcetype":"stash","_time":"2025-07-28T12:50:04.000+02:00","all_risk_objects":"lferrante","annotations.mitre_attack.mitre_description":["Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)\n\nAdversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.","Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.\n\nLocal Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement. "],"annotations.mitre_attack.mitre_detection":["Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).\n\nOn Linux, check logs and other artifacts created by use of domain authentication services, such as the System Security Services Daemon (sssd).(Citation: Ubuntu SSSD Docs) \n\nPerform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.","Perform regular audits of local system accounts to detect accounts that may have been created by an adversary for persistence. Look for suspicious account behavior, such as accounts logged in at odd times or outside of business hours."],"annotations.mitre_attack.mitre_platform":["Linux","macOS","Windows","ESXi","Linux","macOS","Windows","Containers","Network Devices","ESXi"],"annotations.mitre_attack.mitre_tactic":["defense-evasion","persistence","privilege-escalation","initial-access","defense-evasion","persistence","privilege-escalation","initial-access"],"annotations.mitre_attack.mitre_tactic_id":["TA0001","TA0003","TA0004","TA0005"],"annotations.mitre_attack.mitre_technique":["Domain Accounts","Local Accounts"],"annotations.mitre_attack.mitre_technique_id":["T1078.002","T1078.003"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1078/002","https://attack.mitre.org/techniques/T1078/003"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"10","date_mday":"28","date_minute":"50","date_month":"july","date_second":"4","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753612800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753699200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"a821b444-cb4f-4de3-b1a0-a88a4b55c7df@@notable@@a821b444cb4f4de3b1a0a88a4b55c7df","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753699200.000000000","info_min_time":"1753612800.000000000","info_search_time":"1753699800.596903000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"4","mitre_technique_id_count":"2","normalized_risk_object":"lferrante_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"4","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for user=lferrante","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753699800_1461_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753699804","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"lferrante","risk_object_bunit":"ad.ismett.it","risk_object_category":"internal","risk_object_first":"luca","risk_object_identity":"lferrante","risk_object_identity_id":"647f4aff7557e261324eba03","risk_object_identity_tag":["ad.ismett.it","internal"],"risk_object_last":"ferrante","risk_object_priority":"high","risk_object_type":"user","risk_score":"6033418404304953000000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"a821b444-cb4f-4de3-b1a0-a88a4b55c7df@@notable@@a821b444cb4f4de3b1a0a88a4b55c7df","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"a821b444-cb4f-4de3-b1a0-a88a4b55c7df@@notable@@a821b444cb4f4de3b1a0a88a4b55c7df","source_guid":"a821b444-cb4f-4de3-b1a0-a88a4b55c7df","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-02","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753699804","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~44~5D398647-642E-43D4-9788-5FB926D8AAF0","_cd":"44:423407","_eventtype_color":"none","_indextime":"1753699805","_raw":"1753699804, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753699804\", all_risk_objects=\"206.168.34.90\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753699200.000000000\", info_min_time=\"1753612800.000000000\", info_search_time=\"1753699800.596903000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"206.168.34.90_ST91552\", orig_time=\"1753699804\", risk_event_count=\"4\", risk_object=\"206.168.34.90\", risk_object_type=\"system\", risk_score=\"49187712078806335000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=206.168.34.90\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"c1c1e2f0-ac11-466e-a672-25c0ba023efd@@notable@@c1c1e2f0ac11466ea67225c0ba023efd\", source_guid=\"c1c1e2f0-ac11-466e-a672-25c0ba023efd\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"206.168.34.90","_serial":"2","_si":["FW-SIEM-INDEXER-02","notable"],"_sourcetype":"stash","_time":"2025-07-28T12:50:04.000+02:00","all_risk_objects":"206.168.34.90","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"10","date_mday":"28","date_minute":"50","date_month":"july","date_second":"4","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753612800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753699200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"c1c1e2f0-ac11-466e-a672-25c0ba023efd@@notable@@c1c1e2f0ac11466ea67225c0ba023efd","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753699200.000000000","info_min_time":"1753612800.000000000","info_search_time":"1753699800.596903000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"206.168.34.90_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"3","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=206.168.34.90","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753699800_1461_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753699804","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"206.168.34.90","risk_object_type":"system","risk_score":"49187712078806335000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"c1c1e2f0-ac11-466e-a672-25c0ba023efd@@notable@@c1c1e2f0ac11466ea67225c0ba023efd","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"c1c1e2f0-ac11-466e-a672-25c0ba023efd@@notable@@c1c1e2f0ac11466ea67225c0ba023efd","source_guid":"c1c1e2f0-ac11-466e-a672-25c0ba023efd","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-02","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753699804","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~44~5D398647-642E-43D4-9788-5FB926D8AAF0","_cd":"44:423366","_eventtype_color":"none","_indextime":"1753699805","_raw":"1753699804, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753699804\", all_risk_objects=\"192.168.182.73\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753699200.000000000\", info_min_time=\"1753612800.000000000\", info_search_time=\"1753699800.596903000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"192.168.182.73_ST91552\", orig_time=\"1753699804\", risk_event_count=\"4\", risk_object=\"192.168.182.73\", risk_object_type=\"system\", risk_score=\"7797971198321494000000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=192.168.182.73\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"065b1637-97f7-4a05-b9dd-436df4d0e969@@notable@@065b163797f74a05b9dd436df4d0e969\", source_guid=\"065b1637-97f7-4a05-b9dd-436df4d0e969\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"192.168.182.73","_serial":"3","_si":["FW-SIEM-INDEXER-02","notable"],"_sourcetype":"stash","_time":"2025-07-28T12:50:04.000+02:00","all_risk_objects":"192.168.182.73","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"10","date_mday":"28","date_minute":"50","date_month":"july","date_second":"4","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753612800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753699200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"065b1637-97f7-4a05-b9dd-436df4d0e969@@notable@@065b163797f74a05b9dd436df4d0e969","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753699200.000000000","info_min_time":"1753612800.000000000","info_search_time":"1753699800.596903000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"192.168.182.73_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"2","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=192.168.182.73","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753699800_1461_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753699804","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"192.168.182.73","risk_object_type":"system","risk_score":"7797971198321494000000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"065b1637-97f7-4a05-b9dd-436df4d0e969@@notable@@065b163797f74a05b9dd436df4d0e969","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"065b1637-97f7-4a05-b9dd-436df4d0e969@@notable@@065b163797f74a05b9dd436df4d0e969","source_guid":"065b1637-97f7-4a05-b9dd-436df4d0e969","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-02","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753699804","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~44~5D398647-642E-43D4-9788-5FB926D8AAF0","_cd":"44:423316","_eventtype_color":"none","_indextime":"1753699805","_raw":"1753699804, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753699804\", all_risk_objects=\"172.18.16.82\", annotations.mitre_attack=\"None\", annotations.mitre_attack=\"T1110\", annotations.mitre_attack=\"T1201\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_tactic_id=\"TA0006\", annotations.mitre_attack.mitre_tactic_id=\"TA0007\", annotations.mitre_attack.mitre_technique_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"T1110\", annotations.mitre_attack.mitre_technique_id=\"T1201\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753699200.000000000\", info_min_time=\"1753612800.000000000\", info_search_time=\"1753699800.596903000\", mitre_tactic_id_count=\"3\", mitre_technique_id_count=\"3\", normalized_risk_object=\"172.18.16.82_ST91552\", orig_time=\"1753699804\", risk_event_count=\"4\", risk_object=\"172.18.16.82\", risk_object_type=\"system\", risk_score=\"203477595640056740000000000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=172.18.16.82\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"472a0d75-8cce-4e0b-8051-7598ebfb5d55@@notable@@472a0d758cce4e0b80517598ebfb5d55\", source_guid=\"472a0d75-8cce-4e0b-8051-7598ebfb5d55\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"172.18.16.82","_serial":"4","_si":["FW-SIEM-INDEXER-02","notable"],"_sourcetype":"stash","_time":"2025-07-28T12:50:04.000+02:00","all_risk_objects":"172.18.16.82","annotations.mitre_attack.mitre_description":["Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.","Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)<\/code>, <code>Get-ADDefaultDomainPasswordPolicy<\/code>, <code>chage -l <username><\/code>, <code>cat /etc/pam.d/common-password<\/code>, and <code>pwpolicy getaccountpolicies<\/code> (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. <code>show aaa<\/code>, <code>show aaa common-criteria policy all<\/code>).(Citation: US-CERT-TA18-106A)\n\nPassword policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy<\/code> in AWS (Citation: AWS GetPasswordPolicy)."],"annotations.mitre_attack.mitre_detection":["Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.","Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity."],"annotations.mitre_attack.mitre_platform":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider","ESXi","Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"annotations.mitre_attack.mitre_tactic":["credential-access","discovery"],"annotations.mitre_attack.mitre_tactic_id":["None","TA0006","TA0007"],"annotations.mitre_attack.mitre_technique":["Brute Force","Password Policy Discovery"],"annotations.mitre_attack.mitre_technique_id":["None","T1110","T1201"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1110","https://attack.mitre.org/techniques/T1201"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"10","date_mday":"28","date_minute":"50","date_month":"july","date_second":"4","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753612800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753699200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"472a0d75-8cce-4e0b-8051-7598ebfb5d55@@notable@@472a0d758cce4e0b80517598ebfb5d55","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753699200.000000000","info_min_time":"1753612800.000000000","info_search_time":"1753699800.596903000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"3","mitre_technique_id_count":"3","normalized_risk_object":"172.18.16.82_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"1","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=172.18.16.82","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753699800_1461_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753699804","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"172.18.16.82","risk_object_type":"system","risk_score":"203477595640056740000000000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"472a0d75-8cce-4e0b-8051-7598ebfb5d55@@notable@@472a0d758cce4e0b80517598ebfb5d55","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"472a0d75-8cce-4e0b-8051-7598ebfb5d55@@notable@@472a0d758cce4e0b80517598ebfb5d55","source_guid":"472a0d75-8cce-4e0b-8051-7598ebfb5d55","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-02","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753699804","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~44~5D398647-642E-43D4-9788-5FB926D8AAF0","_cd":"44:423275","_eventtype_color":"none","_indextime":"1753699805","_raw":"1753699804, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753699804\", all_risk_objects=\"167.94.145.103\", annotations.mitre_attack=\"None\", annotations.mitre_attack.mitre_tactic_id=\"None\", annotations.mitre_attack.mitre_technique_id=\"None\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753699200.000000000\", info_min_time=\"1753612800.000000000\", info_search_time=\"1753699800.596903000\", mitre_tactic_id_count=\"1\", mitre_technique_id_count=\"1\", normalized_risk_object=\"167.94.145.103_ST91552\", orig_time=\"1753699804\", risk_event_count=\"4\", risk_object=\"167.94.145.103\", risk_object_type=\"system\", risk_score=\"509661315473131300000000\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for system=167.94.145.103\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"d74d1bac-da11-47bc-abaa-1e777ef3c7e1@@notable@@d74d1bacda1147bcabaa1e777ef3c7e1\", source_guid=\"d74d1bac-da11-47bc-abaa-1e777ef3c7e1\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_system":"167.94.145.103","_serial":"5","_si":["FW-SIEM-INDEXER-02","notable"],"_sourcetype":"stash","_time":"2025-07-28T12:50:04.000+02:00","all_risk_objects":"167.94.145.103","annotations.mitre_attack.mitre_tactic_id":"None","annotations.mitre_attack.mitre_technique_id":"None","category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"10","date_mday":"28","date_minute":"50","date_month":"july","date_second":"4","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753612800.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753699200.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"d74d1bac-da11-47bc-abaa-1e777ef3c7e1@@notable@@d74d1bacda1147bcabaa1e777ef3c7e1","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-03","index":"notable","info_max_time":"1753699200.000000000","info_min_time":"1753612800.000000000","info_search_time":"1753699800.596903000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"1","mitre_technique_id_count":"1","normalized_risk_object":"167.94.145.103_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"0","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for system=167.94.145.103","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753699800_1461_D80D26F8-64B5-40FD-83D2-0CB353DD6F12","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753699804","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"4","risk_object":"167.94.145.103","risk_object_type":"system","risk_score":"509661315473131300000000","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"d74d1bac-da11-47bc-abaa-1e777ef3c7e1@@notable@@d74d1bacda1147bcabaa1e777ef3c7e1","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"d74d1bac-da11-47bc-abaa-1e777ef3c7e1@@notable@@d74d1bacda1147bcabaa1e777ef3c7e1","source_guid":"d74d1bac-da11-47bc-abaa-1e777ef3c7e1","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-02","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753699804","timeendpos":"230","timestartpos":"220","urgency":"high"},{"_bkt":"notable~39~37F94E49-E460-439F-91B7-5D6BD7E5912C","_cd":"39:475040","_eventtype_color":"none","_indextime":"1753699507","_raw":"1753699504, search_name=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", _time=\"1753699504\", all_risk_objects=\"dlopez-admin\", annotations.mitre_attack=\"T1078.003\", annotations.mitre_attack=\"T1136.001\", annotations.mitre_attack=\"T1485\", annotations.mitre_attack.mitre_tactic_id=\"TA0001\", annotations.mitre_attack.mitre_tactic_id=\"TA0003\", annotations.mitre_attack.mitre_tactic_id=\"TA0004\", annotations.mitre_attack.mitre_tactic_id=\"TA0005\", annotations.mitre_attack.mitre_tactic_id=\"TA0040\", annotations.mitre_attack.mitre_technique_id=\"T1078.003\", annotations.mitre_attack.mitre_technique_id=\"T1136.001\", annotations.mitre_attack.mitre_technique_id=\"T1485\", cim_entity_zone=\"ST91552\", customer_id=\"ST91552\", info_max_time=\"1753698900.000000000\", info_min_time=\"1753612500.000000000\", info_search_time=\"1753699500.806096000\", mitre_tactic_id_count=\"5\", mitre_technique_id_count=\"3\", normalized_risk_object=\"dlopez-admin_ST91552\", orig_time=\"1753699504\", risk_event_count=\"3\", risk_object=\"dlopez-admin\", risk_object_type=\"user\", risk_score=\"11617965\", risk_threshold=\"100\", orig_rule_description=\"Risk Threshold Exceeded for an object over a 24 hour period\", orig_rule_title=\"24 hour risk threshold exceeded for user=dlopez-admin\", orig_security_domain=\"threat\", severity=\"critical\", orig_source=\"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule\", source_count=\"1\", source_event_id=\"b9fa62b9-063d-4bae-8945-0aa043fa5ba7@@notable@@b9fa62b9063d4bae89450aa043fa5ba7\", source_guid=\"b9fa62b9-063d-4bae-8945-0aa043fa5ba7\", orig_tag=\"ST91552\", orig_tag=\"modaction_result\"","_risk_user":"dlopez-admin","_serial":"23","_si":["FW-SIEM-INDEXER-01","notable"],"_sourcetype":"stash","_time":"2025-07-28T12:45:04.000+02:00","all_risk_objects":"dlopez-admin","annotations.mitre_attack.mitre_description":["Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.\n\nLocal Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement. ","Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. \n\nFor example, with a sufficient level of access, the Windows <code>net user /add<\/code> command can be used to create a local account.  In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create<\/code> command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username<\/code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.","Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del<\/code> and <code>rm<\/code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).\n\nIn cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ  - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments."],"annotations.mitre_attack.mitre_detection":["Perform regular audits of local system accounts to detect accounts that may have been created by an adversary for persistence. Look for suspicious account behavior, such as accounts logged in at odd times or outside of business hours.","Monitor for processes and command-line parameters associated with local account creation, such as <code>net user /add<\/code> , <code>useradd<\/code> , and <code>dscl -create<\/code> . Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows system. (Citation: Microsoft User Creation Event) Perform regular audits of local system accounts to detect suspicious accounts that may have been created by an adversary. For network infrastructure devices, collect AAA logging to monitor for account creations.","Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under <code>C:\\Windows\\System32\\<\/code>.\n\nIn cloud environments, the occurrence of anomalous high-volume deletion events, such as the <code>DeleteDBCluster<\/code> and <code>DeleteGlobalCluster<\/code> events in AWS, or a high quantity of data deletion events, such as <code>DeleteBucket<\/code>, within a short period of time may indicate suspicious activity."],"annotations.mitre_attack.mitre_platform":["Linux","macOS","Windows","Containers","Network Devices","ESXi","Linux","macOS","Windows","Network Devices","Containers","ESXi","Windows","IaaS","Linux","macOS","Containers","ESXi"],"annotations.mitre_attack.mitre_tactic":["defense-evasion","persistence","privilege-escalation","initial-access","persistence","impact"],"annotations.mitre_attack.mitre_tactic_id":["TA0001","TA0003","TA0004","TA0005","TA0040"],"annotations.mitre_attack.mitre_technique":["Local Accounts","Local Account","Data Destruction"],"annotations.mitre_attack.mitre_technique_id":["T1078.003","T1136.001","T1485"],"annotations.mitre_attack.mitre_url":["https://attack.mitre.org/techniques/T1078/003","https://attack.mitre.org/techniques/T1136/001","https://attack.mitre.org/techniques/T1485"],"category":"Other","cim_entity_zone":"ST91552","customer_id":"ST91552","date_hour":"10","date_mday":"28","date_minute":"45","date_month":"july","date_second":"4","date_wday":"monday","date_year":"2025","date_zone":"0","disposition":"disposition:6","disposition_default":"true","disposition_description":"A disposition is not configured for the finding.","disposition_label":"Undetermined","drilldown_dashboards":"[]","drilldown_earliest":"1753612500.000000000","drilldown_earliest_offset":"$info_min_time$","drilldown_latest":"1753698900.000000000","drilldown_latest_offset":"$info_max_time$","drilldown_searches":"[{\"name\":\"View the individual Risk Attributions\",\"search\":\"| from datamodel:\\\"Risk.All_Risk\\\" \\n| search normalized_risk_object=$normalized_risk_object \\n| s$ risk_object_type=$risk_object_type \\n| s$ \\n| `get_correlations` \\n| rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique \\n| noop search_optimization.search_expansion=false\",\"earliest_offset\":\"$info_min_time$\",\"latest_offset\":\"$info_max_time$\"}]","event_id":"b9fa62b9-063d-4bae-8945-0aa043fa5ba7@@notable@@b9fa62b9063d4bae89450aa043fa5ba7","eventtype":["check_customer_id_ST91552","modnotable_results","notable","risk_notables"],"extract_artifacts":"{\"asset\":[\"src\",\"dest\",\"dvc\",\"orig_host\",\"_risk_system\"],\"identity\":[\"src_user\",\"user\",\"_risk_user\"]}","host":"FW-SIEM-SH-02","index":"notable","info_max_time":"1753698900.000000000","info_min_time":"1753612500.000000000","info_search_time":"1753699500.806096000","investigation_profiles":"{}","killchain":"None","linecount":"1","mitre_sub_technique":"None","mitre_tactic_id_count":"5","mitre_technique_id_count":"3","normalized_risk_object":"dlopez-admin_ST91552","notable_type":"risk_event","orig_action_name":"notable","orig_rid":"5","orig_rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","orig_rule_title":"24 hour risk threshold exceeded for user=dlopez-admin","orig_security_domain":"threat","orig_sid":"scheduler__admin_U0EtVGhyZWF0SW50ZWxsaWdlbmNl__RMD500c563b30afe586e_at_1753699500_1510_D34CA89D-17B5-4F96-AFF9-467186286F97","orig_source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","orig_tag":["ST91552","modaction_result"],"orig_time":"1753699504","owner":"unassigned","owner_realname":"unassigned","priority":"unknown","risk_event_count":"3","risk_object":"dlopez-admin","risk_object_bunit":"ad.ismett.it","risk_object_category":"admin","risk_object_first":"dario (admin account)","risk_object_identity":"dlopez-admin","risk_object_identity_id":"647f4aff7557e261324eb9d8","risk_object_identity_tag":["ad.ismett.it","admin"],"risk_object_last":"lopez","risk_object_priority":"critical","risk_object_type":"user","risk_score":"11617965","risk_threshold":"100","rule_description":"Risk Threshold Exceeded for an object over a 24 hour period","rule_id":"b9fa62b9-063d-4bae-8945-0aa043fa5ba7@@notable@@b9fa62b9063d4bae89450aa043fa5ba7","rule_name":"FW - Risk Threshold Exceeded For Object Over 24 Hour Period","rule_title":"24 hour risk threshold exceeded for $risk_object_type$=$risk_object$","savedsearch_description":"RBA: Risk Threshold exceeded for an object within the previous 24 hours.","search_name":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","search_title":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","security_domain":"threat","severities":"critical","severity":"critical","source":"Threat - FW - Risk Threshold Exceeded For Object Over 24 Hour Period - Rule","source_count":"1","source_event_id":"b9fa62b9-063d-4bae-8945-0aa043fa5ba7@@notable@@b9fa62b9063d4bae89450aa043fa5ba7","source_guid":"b9fa62b9-063d-4bae-8945-0aa043fa5ba7","sourcetype":"stash","splunk_server":"FW-SIEM-INDEXER-01","status":"1","status_default":"true","status_description":"Finding is recent and not reviewed.","status_end":"false","status_group":"New","status_label":"New","tag":["ST91552","modaction_result","rvista"],"tag::eventtype":["ST91552","modaction_result"],"time":"1753699504","timeendpos":"230","timestartpos":"220","urgency":"high"}], "tags":{"eventtype":{"check_customer_id_ST91552":["ST91552"],"modnotable_results":["modaction_result"]},"owner_realname":{"unassigned":["rvista"]}}, "highlighted":{}}
\ No newline at end of file