Spreadsheet: 756120d1637286419-extract-a-string-from-variable-text-mitre-filterxml-dj3
Sheet: Sheet1

alerts |  |  |  |  | =SUBSTITUTE(FILTERXML("<F><d>"&SUBSTITUTE(SUBSTITUTE(SUBSTITUTE(SUBSTITUTE(A2,"_"," "),"-"," "),")",") ")," ","</d><d>")&"</d></F>","//d[translate(.,'[PHONE]','')!=. and string-length()>3 and not(starts-with(., 'P'))][1]"),")","")
mitre_T1071.001 Communication with known [NAME] ip's
MITRE_T1133_User VPN Login from new Country
Query Registry-Reg Process (mitre_t1012)/Alert
Event Triggered Execution: WMI Event Subscription-events mitre_t1546.003)/Alert
mitre T1110.003 Multiple Users Attempting To Authenticate Using Explicit Credentials
mitre T1110.003 Multiple Users Failing To Authenticate From Host Using Kerberos
mitre_t1033_1 System User Discovery Net Commands/Alert
mitre T1110.003 Multiple Users Remotely Failing To Authenticate From Host
MITRE_T1110.003_Multiple Disabled Users Failing To Authenticate From Host Using Kerberos
mitre T1110.003 Multiple Invalid Users Failing To Authenticate From Host Using NTLM
External Remote Services by src - F5 (MITRE T1133)
Network Sniffing 2 (MITRE 1040) /Alert
Unsecured Credentials: Plaintext in [NAME] (MITRE T1552) / Alert
Unsecured Credentials (MITRE T1552.003)
Phishing: Spearphishing via Service (MITRE T1566.003) / Alert
Unsecured Credentials: Plaintext in bulksms (MITRE T1552) / Alert
System Network Connections Discovery-linux (mitre_t1049)
mitre_t1021.004_1st_time user logon to unix server
Remote Desktop Network Bruteforce  (Mitre T1021.001)
mitre_t1560.001.1 7zip Archive Utility Used via Commandline /Alert
Remote Desktop Network Traffic  (Mitre T1021.001)
Splunk Report: Command and Scripting Interpreter:JavaScript (mitre_t1059.007)
Extract and Transfer Private SSH Keys in Linux (MITRE T1552.001) / Alert
External SMB or SSH Traffic Allowed (MITRE T1071) / Alert
Compile After Delivery / Alert (MITRE T1027.004)
Brute Force (mitre_t1110) / Alert
[NAME] (MITRE 1046) / Alert
Event Triggered Execution: Windows Management Instrumentation (mitre_t1546.003)/Alert
Phishing: SPF verification failed (MITRE T1566) / Alert
Large Web Upload (MITRE T1041)
External Remote Services - F5 (MITRE T1133)
[NAME]  IDS-Vulnerability Scanners - Inbound
MITRE_T1008_Possible C2 traffic detected
Exploit Public-Facing Application - SQL Injection v2 (MITRE T1190)
Exploit Public-Facing Application - XSS (MITRE T1190)
Exploit Public-Facing Application - Dir Browsing (MITRE T1190)
mitre_t1595.001 Vulnerability Scanners - Inbound
Encrypted Channel: Symmetric Cryptography (MITRE T1573.001)
MITRE_T1102.002-Proxy outgoing persistent traffic direct to external ip
Abuse Elevation Control Mechanism: Sudo and [NAME] (MITRE T1548.003)/A
Windows Management Instrumentation Network traffic [NAME] (mitre_t1047)
Detect processes used for System Network Configuration Discovery (Mitre T1016) / Alert
Detect hosts connecting to dynamic domain providers - (MITRE-T1189)
OS Credential Dumping 8 (MITRE T1003) /Alert
Permission Groups Discovery: Domain Groups (MITRE T1069.002) / Alert
Splunk Report: User Execution: [NAME] renamed processes (mitre_t1204.002)
MITRE-T1090.002-Long Established Connection Over Proxy
Brute Force: Password Spraying (mitre_t1110.003) / Alert
mitre-T1110.003 Multiple Invalid Users Failing To Authenticate From Host Using Kerberos
Unsecured Credentials: Plaintext over HTTP (MITRE T1552)
[NAME] (MITRE 1040) /Alert
Inter-Process Communication: Component Object Model (MITRE 1559.001)
Splunk Report: Command and Scripting Interpreter:JavaScript -loading [NAME] (mitre_t1059.007)
Exploit Public-Facing Application - Path Traversal (MITRE T1190)
Protocol Tunneling (MITRE T1572)/A
Detect P2P Proxy traffic (MITRE T1090.001) / Alert
Data Encoding: Standard Encoding 4 (MITRE 1132.001) /Alert
OS Credential Dumping 3 (MITRE T1003) /Alert
Multi-Stage Channels (MITRE T1104)
Credentials from Password Stores - Backdoor domains (MITRE T1555.003)
Hide Artifacts: Hidden or Minimized Window (MITRE T1564.003)
Network Sniffing 3 (MITRE 1040) /Alert
Remote Desktop Network Traffic   ([NAME])
Spearphishing Attachment (MITRE 1566.001) / Alert
Automated Collection  (MITRE T1119)/Alert
mitre_t1021.004 Auth from same src and user to multiple destinations
Command and Scripting Interpreter: Python (mitre_t1059.006)
mitre_t1135 Network Share Scan
Detect Process Doppelgänging (MITRE T1055.013) / Alert
Permission Groups Discovery: Local Groups (MITRE T1069.001) / Alert
Clipboard Data 3 (MITRE T1115) /Alert
MITRE-T1001.Data Obfuscation
Protocol Tunneling - tools (MITRE T1572)/A
System Services: Service Execution - psexec.exe pn (MITRE T1569.002)/A
System Services: Service Execution - psexec.exe on (MITRE T1569.002)/A
Protocol Tunneling - local/remote port forwarding (MITRE T1572)/A
mitre_t113_3.2 Screen Capture bmp File Created /Alert
mitre_t113_1 Screen Capture Upload /Alerts