Update taxonomy to be more consistent

.index.json

@@ -8988,7 +8988,7 @@
   },
   "crowdsecurity/CVE-2023-4911": {
    "path": "scenarios/crowdsecurity/CVE-2023-4911.yaml",
-   "version": "0.5",
+   "version": "0.6",
    "versions": {
     "0.1": {
      "digest": "c9be24878aab5602152e6873ee337e62eb3edb0e2ce9b3d2c873ee7112660379",
@@ -9009,13 +9009,17 @@
     "0.5": {
      "digest": "f5a94401d7320b28d98147631aed97d6e9912ae842fc17efebd5239a105eed28",
      "deprecated": false
+    },
+    "0.6": {
+     "digest": "7af1594c47d034e3c39b10ccf4058d6a17b1d63fe33f81814e4e8977d6d2548b",
+     "deprecated": false
     }
    },
-   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTQ5MTEKZGVzY3JpcHRpb246ICJleHBsb2l0YXRpb24gb2YgQ1ZFLTIwMjMtNDkxMTogc2VnZmF1bHRpbmcgaW4gZHluYW1pYyBsb2FkZXIiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdrZXJuZWwnICYmIGV2dC5NZXRhLnN1Yl9sb2dfdHlwZSA9PSAnc2VnZmF1bHQnICYmIGV2dC5NZXRhLmxpYnJhcnkgc3RhcnRzV2l0aCAnbGQtbGludXgtJyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1NDguMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpleHBsb2l0YXRpb24iCiAgbGFiZWw6ICJDVkUtMjAyMy00OTExIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IGV4ZQogIGV4cHJlc3Npb246IGV2dC5NZXRhLmJpbmFyeQo=",
+   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTQ5MTEKZGVzY3JpcHRpb246ICJleHBsb2l0YXRpb24gb2YgQ1ZFLTIwMjMtNDkxMTogc2VnZmF1bHRpbmcgaW4gZHluYW1pYyBsb2FkZXIiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdrZXJuZWwnICYmIGV2dC5NZXRhLnN1Yl9sb2dfdHlwZSA9PSAnc2VnZmF1bHQnICYmIGV2dC5NZXRhLmxpYnJhcnkgc3RhcnRzV2l0aCAnbGQtbGludXgtJyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1NDguMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpleHBsb2l0IgogIGxhYmVsOiAiQ1ZFLTIwMjMtNDkxMSIKICBzZXJ2aWNlOiBsaW51eAogIHJlbWVkaWF0aW9uOiBmYWxzZQpzY29wZToKICB0eXBlOiBleGUKICBleHByZXNzaW9uOiBldnQuTWV0YS5iaW5hcnkK",
    "description": "exploitation of CVE-2023-4911: segfaulting in dynamic loader",
    "author": "crowdsecurity",
    "labels": {
-    "behavior": "linux:exploitation",
+    "behavior": "linux:exploit",
     "classification": [
      "attack.T1548.004"
     ],
@@ -9349,7 +9353,7 @@
   },
   "crowdsecurity/auditd-suid-crash": {
    "path": "scenarios/crowdsecurity/auditd-suid-crash.yaml",
-   "version": "0.6",
+   "version": "0.7",
    "versions": {
     "0.1": {
      "digest": "363efa4bbcda1abd870a49673ab402da63312259200e69bf9f80d565b24e4f45",
@@ -9374,14 +9378,18 @@
     "0.6": {
      "digest": "de0dd532eba64e3b20c8ef7103e8523c36248bbb13ed09239ace03e88b5d1862",
      "deprecated": false
+    },
+    "0.7": {
+     "digest": "0ccbfea09f7e9a8eb5f207bc6a4c3da3f91b917acf387da6aaa0adf0357b76f0",
+     "deprecated": false
     }
    },
    "long_description": "IyMgQXVkaXRkIDogQ3Jhc2ggb2Ygc3VpZCBiaW5hcnkKCkF0dGVtcHQgdG8gZGV0ZWN0IGEgU1VJRCBiaW5hcnkgdGhhdCBjcmFzaGVzIHdpdGggYFNJR0lMTGAsIGBTSUdUUkFQYCwgYFNJR0FCUlRgLCBgU0lHQlVTYCwgYFNJR1NFR1ZgLgoKSXQgbWlnaHQgYmUgcmVsYXRlZCB0byBzb21lb25lIHRyeWluZyB0byBleHBsb2l0IGxvY2FsIHByaXZpbGVnZSBlc2NhbGF0aW9uIHN1Y2ggYXMgW0NWRS0yMDIzLTQ5MTFdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIzLTQ5MTEpLgo=",
-   "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtc3VpZC1jcmFzaApkZXNjcmlwdGlvbjogIkRldGVjdCByb290IHN1aWQgcHJvY2VzcyBjcmFzaGluZyIKZmlsdGVyOiB8CiAgKGV2dC5NZXRhLmxvZ190eXBlID09ICdleGVjdmUnICYmIGV2dC5NZXRhLmV1aWQgPT0gJzAnICYmIGV2dC5NZXRhLmF1aWQgIT0gJzAnKSB8fAogIChldnQuTWV0YS5sb2dfdHlwZSA9PSAnYW5vbV9hYmVuZCcgJiYgZXZ0Lk1ldGEuc2lnIGluIFsiNCIsICI1IiwgIjYiLCAiNyIsICIxMSJdKQpncm91cGJ5OiBldnQuTWV0YS5waWQKZGlzdGluY3Q6IGV2dC5NZXRhLmxvZ190eXBlCmNvbmRpdGlvbjogfAogIGxlbihxdWV1ZS5RdWV1ZSkgPj0gMiBhbmQgCiAgICBxdWV1ZS5RdWV1ZVswXS5NZXRhLmV4ZSA9PSBxdWV1ZS5RdWV1ZVsxXS5NZXRhLmV4ZQpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAtMQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU0OC4wMDQKICBiZWhhdmlvcjogImxpbnV4OmV4cGxvaXRhdGlvbiIKICBsYWJlbDogIlN1c3BpY2lvdXMgc3VpZCBwcm9jZXNzIGNyYXNoIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IGV4ZQogIGV4cHJlc3Npb246IGV2dC5NZXRhLmV4ZQo=",
+   "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtc3VpZC1jcmFzaApkZXNjcmlwdGlvbjogIkRldGVjdCByb290IHN1aWQgcHJvY2VzcyBjcmFzaGluZyIKZmlsdGVyOiB8CiAgKGV2dC5NZXRhLmxvZ190eXBlID09ICdleGVjdmUnICYmIGV2dC5NZXRhLmV1aWQgPT0gJzAnICYmIGV2dC5NZXRhLmF1aWQgIT0gJzAnKSB8fAogIChldnQuTWV0YS5sb2dfdHlwZSA9PSAnYW5vbV9hYmVuZCcgJiYgZXZ0Lk1ldGEuc2lnIGluIFsiNCIsICI1IiwgIjYiLCAiNyIsICIxMSJdKQpncm91cGJ5OiBldnQuTWV0YS5waWQKZGlzdGluY3Q6IGV2dC5NZXRhLmxvZ190eXBlCmNvbmRpdGlvbjogfAogIGxlbihxdWV1ZS5RdWV1ZSkgPj0gMiBhbmQgCiAgICBxdWV1ZS5RdWV1ZVswXS5NZXRhLmV4ZSA9PSBxdWV1ZS5RdWV1ZVsxXS5NZXRhLmV4ZQpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAtMQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU0OC4wMDQKICBiZWhhdmlvcjogImxpbnV4OmV4cGxvaXQiCiAgbGFiZWw6ICJTdXNwaWNpb3VzIHN1aWQgcHJvY2VzcyBjcmFzaCIKICBzZXJ2aWNlOiBsaW51eAogIHJlbWVkaWF0aW9uOiBmYWxzZQpzY29wZToKICB0eXBlOiBleGUKICBleHByZXNzaW9uOiBldnQuTWV0YS5leGUK",
    "description": "Detect root suid process crashing",
    "author": "crowdsecurity",
    "labels": {
-    "behavior": "linux:exploitation",
+    "behavior": "linux:exploit",
     "classification": [
      "attack.T1548.004"
     ],
@@ -11645,7 +11653,7 @@
   },
   "crowdsecurity/iptables-scan-multi_ports": {
    "path": "scenarios/crowdsecurity/iptables-scan-multi_ports.yaml",
-   "version": "0.2",
+   "version": "0.3",
    "versions": {
     "0.1": {
      "digest": "85bd908ec6efae802035e4553f5dd41e4d5b6b53b2f237dd256533965bd44cd7",
@@ -11654,11 +11662,15 @@
     "0.2": {
      "digest": "af7ec1e0af8a778d80f6de3c8d28c15fdce53882e7cd5c8e3291e397b6ac4985",
      "deprecated": false
+    },
+    "0.3": {
+     "digest": "86fc4b0fdc88e0ba1898e5f789905ac5e3517f3167caae35edf8dd39d68bdfb0",
+     "deprecated": false
     }
    },
    "long_description": "RGV0ZWN0cyBhIHBvcnQgc2NhbiA6IGRldGVjdHMgaWYgYSBzaW5nbGUgSVAgYXR0ZW1wdHMgY29ubmVjdGlvbiB0byBtYW55IGRpZmZlcmVudCBwb3J0cy4KCkxlYWtzcGVlZCBvZiA1cywgY2FwYWNpdHkgb2YgMTUuCg==",
-   "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9pcHRhYmxlcy1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2lwdGFibGVzX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0LlBhcnNlZC5kc3RfcG9ydApjYXBhY2l0eTogMTUKbGVha3NwZWVkOiA1cwpibGFja2hvbGU6IDFtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUuMDAxCiAgICAtIGF0dGFjay5UMTAxOAogICAgLSBhdHRhY2suVDEwNDYKICBiZWhhdmlvcjogInRjcDpzY2FuIgogIGxhYmVsOiAiVENQIFBvcnQgU2NhbiIKICBzcG9vZmFibGU6IDMKICBjb25maWRlbmNlOiAxCg==",
-   "description": "ban IPs that are scanning us",
+   "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9pcHRhYmxlcy1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFRDUCBzY2FuIG9uIG11bHRpcGxlIHBvcnRzIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnaXB0YWJsZXNfZHJvcCcgJiYgZXZ0Lk1ldGEuc2VydmljZSA9PSAndGNwJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuUGFyc2VkLmRzdF9wb3J0CmNhcGFjaXR5OiAxNQpsZWFrc3BlZWQ6IDVzCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NS4wMDEKICAgIC0gYXR0YWNrLlQxMDE4CiAgICAtIGF0dGFjay5UMTA0NgogIGJlaGF2aW9yOiAidGNwOnNjYW4iCiAgbGFiZWw6ICJUQ1AgUG9ydCBTY2FuIgogIHNwb29mYWJsZTogMwogIGNvbmZpZGVuY2U6IDEK",
+   "description": "Detect TCP scan on multiple ports",
    "author": "crowdsecurity",
    "labels": {
     "behavior": "tcp:scan",
@@ -13047,7 +13059,7 @@
   },
   "crowdsecurity/windows-CVE-2022-30190-msdt": {
    "path": "scenarios/crowdsecurity/windows-CVE-2022-30190-msdt.yaml",
-   "version": "0.2",
+   "version": "0.3",
    "versions": {
     "0.1": {
      "digest": "6cac369ca1553245cf9a837275492822387a43a0a4f138560dfdda208def1103",
@@ -13056,14 +13068,18 @@
     "0.2": {
      "digest": "2e41d1c94e7af7e2cdb8eb0c22152a44f320b9e7ef00b6604b3f77977e86f3ed",
      "deprecated": false
+    },
+    "0.3": {
+     "digest": "72686edaab2f083196376f0658620382c46e3bb66922082f05e93c4d451fe5b0",
+     "deprecated": false
     }
    },
    "long_description": "VGhpcyBzY2VuYXJpbyBkZXRlY3RzIHNvbWUgYXR0ZW1wdHMgYXQgZXhwbG9pdGluZyBbQ1ZFLTIwMjItMzAxOTBdKGh0dHBzOi8vbXNyYy1ibG9nLm1pY3Jvc29mdC5jb20vMjAyMi8wNS8zMC9ndWlkYW5jZS1mb3ItY3ZlLTIwMjItMzAxOTAtbWljcm9zb2Z0LXN1cHBvcnQtZGlhZ25vc3RpYy10b29sLXZ1bG5lcmFiaWxpdHkvKSBvbiBXaW5kb3dzLgoKSXQgZG9lcyBzbyBieSBwYXJzaW5nIHN5c21vbiBsb2dzLCBtb3JlIHNwZWNpZmljYWxseSB0aGUgb25lIHdpdGggZXZlbnQgSUQgMSAocHJvY2VzcyBjcmVhdGlvbikuCgpUaGlzIG1lYW5zIHRoYXQgeW91IG5lZWQgYSB3b3JraW5nIHN5c21vbiBpbnN0YWxsYXRpb24gdG8gYmUgYWJsZSB0byB1c2UgdGhpcyBzY2VuYXJpby4g",
-   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTMwMTkwLW1zZHQKZGVzY3JpcHRpb246ICJEZXRlY3QgQ1ZFLTIwMjItMzAxOTAgZnJvbSBzeXNtb24gZXZlbnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5zZXJ2aWNlID09ICdzeXNtb24nICYmIGV2dC5QYXJzZWQuRXZlbnRJRCA9PSAnMScgJiYgCiAgVXBwZXIoZXZ0LlBhcnNlZC5JbWFnZSkgZW5kc1dpdGggJ01TRFQuRVhFJyAmJiAKICBVcHBlcihldnQuUGFyc2VkLlBhcmVudEltYWdlKSBlbmRzV2l0aCAnV0lOV09SRC5FWEUnICYmCiAgKFVwcGVyKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUpIGNvbnRhaW5zICdQQ1dESUFHTk9TVElDJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfUkVCUk9XU0VGT1JGSUxFJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfQlJPV1NFRk9SRklMRScpCmxhYmVsczoKICB0eXBlOiByY2UKICBub3RpZmljYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA1OQogICAgLSBhdHRhY2suVDEyMDMKICAgIC0gY3ZlLkNWRS0yMDIyLTMwMTkwCiAgYmVoYXZpb3JzOiAid2luZG93czpyY2UiCiAgbGFiZWw6ICJDVkUtMjAyMi0zMDE5MCIKICBzZXJ2aWNlOiB3aW5kb3dzCnNjb3BlOgogIHR5cGU6IHVzZXJfYWNjb3VudAogIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuVXNlcgo=",
+   "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTMwMTkwLW1zZHQKZGVzY3JpcHRpb246ICJEZXRlY3QgQ1ZFLTIwMjItMzAxOTAgZnJvbSBzeXNtb24gZXZlbnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5zZXJ2aWNlID09ICdzeXNtb24nICYmIGV2dC5QYXJzZWQuRXZlbnRJRCA9PSAnMScgJiYgCiAgVXBwZXIoZXZ0LlBhcnNlZC5JbWFnZSkgZW5kc1dpdGggJ01TRFQuRVhFJyAmJiAKICBVcHBlcihldnQuUGFyc2VkLlBhcmVudEltYWdlKSBlbmRzV2l0aCAnV0lOV09SRC5FWEUnICYmCiAgKFVwcGVyKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUpIGNvbnRhaW5zICdQQ1dESUFHTk9TVElDJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfUkVCUk9XU0VGT1JGSUxFJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfQlJPV1NFRk9SRklMRScpCmxhYmVsczoKICB0eXBlOiByY2UKICBub3RpZmljYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA1OQogICAgLSBhdHRhY2suVDEyMDMKICAgIC0gY3ZlLkNWRS0yMDIyLTMwMTkwCiAgYmVoYXZpb3JzOiAid2luZG93czpleHBsb2l0IgogIGxhYmVsOiAiQ1ZFLTIwMjItMzAxOTAiCiAgc2VydmljZTogd2luZG93cwpzY29wZToKICB0eXBlOiB1c2VyX2FjY291bnQKICBleHByZXNzaW9uOiBldnQuUGFyc2VkLlVzZXIK",
    "description": "Detect CVE-2022-30190 from sysmon events",
    "author": "crowdsecurity",
    "labels": {
-    "behaviors": "windows:rce",
+    "behaviors": "windows:exploit",
     "classification": [
      "attack.T1059",
      "attack.T1203",
@@ -13166,7 +13182,7 @@
   },
   "firewallservices/pf-scan-multi_ports": {
    "path": "scenarios/firewallservices/pf-scan-multi_ports.yaml",
-   "version": "0.4",
+   "version": "0.5",
    "versions": {
     "0.1": {
      "digest": "d650a9e64532d14a46dcf5bfc952b0a0eb1825efdb07a179069d9c7f8f185d78",
@@ -13183,11 +13199,15 @@
     "0.4": {
      "digest": "a8017247b648a5b731414ea6e7923b12d8da86ae0be535b96aa122ac65653b1f",
      "deprecated": false
+    },
+    "0.5": {
+     "digest": "0016363f0aac918daf318c9b618df40edae65f8711848096528a5526743afec9",
+     "deprecated": false
     }
    },
    "long_description": "RGV0ZWN0cyBUQ1AgcG9ydCBzY2FuIDogZGV0ZWN0cyBpZiBhIHNpbmdsZSBJUCBhdHRlbXB0cyBjb25uZWN0aW9uIHRvIG1hbnkgZGlmZmVyZW50IHBvcnRzLgoKTGVha3NwZWVkIG9mIDVzLCBjYXBhY2l0eSBvZiAxNS4K",
-   "content": "dHlwZTogbGVha3kKbmFtZTogZmlyZXdhbGxzZXJ2aWNlcy9wZi1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3BmX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0LlBhcnNlZC5kc3RfcG9ydApjYXBhY2l0eTogMTUKbGVha3NwZWVkOiA1cwpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiB0Y3AKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAzCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NS4wMDEKICAgIC0gYXR0YWNrLlQxMDE4CiAgICAtIGF0dGFjay5UMTA0NgogIGJlaGF2aW9yOiAidGNwOnNjYW4iCiAgbGFiZWw6ICJQRiBTY2FuIE11bHRpIFBvcnRzIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==",
-   "description": "ban IPs that are scanning us",
+   "content": "dHlwZTogbGVha3kKbmFtZTogZmlyZXdhbGxzZXJ2aWNlcy9wZi1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFRDUCBzY2FuIG9uIG11bHRpcGxlIHBvcnRzIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAncGZfZHJvcCcgJiYgZXZ0Lk1ldGEuc2VydmljZSA9PSAndGNwJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuUGFyc2VkLmRzdF9wb3J0CmNhcGFjaXR5OiAxNQpsZWFrc3BlZWQ6IDVzCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IHRjcAogIGNvbmZpZGVuY2U6IDEKICBzcG9vZmFibGU6IDMKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1LjAwMQogICAgLSBhdHRhY2suVDEwMTgKICAgIC0gYXR0YWNrLlQxMDQ2CiAgYmVoYXZpb3I6ICJ0Y3A6c2NhbiIKICBsYWJlbDogIlRDUCBQb3J0IFNjYW4iCiAgcmVtZWRpYXRpb246IHRydWUK",
+   "description": "Detect TCP scan on multiple ports",
    "author": "firewallservices",
    "labels": {
     "behavior": "tcp:scan",
@@ -13197,7 +13217,7 @@
      "attack.T1046"
     ],
     "confidence": 1,
-    "label": "PF Scan Multi Ports",
+    "label": "TCP Port Scan",
     "remediation": true,
     "service": "tcp",
     "spoofable": 3

scenarios/crowdsecurity/CVE-2023-4911.yaml

@@ -8,7 +8,7 @@ labels:
   spoofable: 0
   classification:
     - attack.T1548.004
-  behavior: "linux:exploitation"
+  behavior: "linux:exploit"
   label: "CVE-2023-4911"
   service: linux
   remediation: false

scenarios/crowdsecurity/auditd-suid-crash.yaml

@@ -17,7 +17,7 @@ labels:
   spoofable: 0
   classification:
     - attack.T1548.004
-  behavior: "linux:exploitation"
+  behavior: "linux:exploit"
   label: "Suspicious suid process crash"
   service: linux
   remediation: false

scenarios/crowdsecurity/iptables-scan-multi_ports.yaml

@@ -1,6 +1,6 @@
 type: leaky
 name: crowdsecurity/iptables-scan-multi_ports
-description: "ban IPs that are scanning us"
+description: "Detect TCP scan on multiple ports"
 filter: "evt.Meta.log_type == 'iptables_drop' && evt.Meta.service == 'tcp'"
 groupby: evt.Meta.source_ip
 distinct: evt.Parsed.dst_port

scenarios/crowdsecurity/windows-CVE-2022-30190-msdt.yaml

@@ -15,7 +15,7 @@ labels:
     - attack.T1059
     - attack.T1203
     - cve.CVE-2022-30190
-  behaviors: "windows:rce"
+  behaviors: "windows:exploit"
   label: "CVE-2022-30190"
   service: windows
 scope:

scenarios/firewallservices/pf-scan-multi_ports.yaml

@@ -1,6 +1,6 @@
 type: leaky
 name: firewallservices/pf-scan-multi_ports
-description: "ban IPs that are scanning us"
+description: "Detect TCP scan on multiple ports"
 filter: "evt.Meta.log_type == 'pf_drop' && evt.Meta.service == 'tcp'"
 groupby: evt.Meta.source_ip
 distinct: evt.Parsed.dst_port
@@ -16,5 +16,5 @@ labels:
     - attack.T1018
     - attack.T1046
   behavior: "tcp:scan"
-  label: "PF Scan Multi Ports"
+  label: "TCP Port Scan"
   remediation: true

taxonomy/behaviors.json

@@ -119,10 +119,10 @@
         "label": "SMB/RDP bruteforce",
         "name": "windows:bruteforce"
     },
-    "windows:rce": {
+    "windows:exploit": {
         "description": "IP has been reported for exploiting Windows",
         "label": "Windows Exploit",
-        "name": "windows:rce"
+        "name": "windows:exploit"
     },
     "linux:post-exploitation": {
         "description": "IP has been reported for post exploitation on Linux",
@@ -164,9 +164,9 @@
         "label": "K8s Audit",
         "name": "k8s:audit"
     },
-    "linux:exploitation": {
+    "linux:exploit": {
         "description": "Attempt to exploit a Linux vulnerability to escalate privilege",
         "label": "Linux Exploitation",
-        "name": "linux:exploitation"
+        "name": "linux:exploit"
     }
 }

taxonomy/scenarios.json

@@ -1800,7 +1800,7 @@
     "description": "exploitation of CVE-2023-4911: segfaulting in dynamic loader",
     "label": "CVE-2023-4911",
     "behaviors": [
-      "linux:exploitation"
+      "linux:exploit"
     ],
     "mitre_attacks": [
       "TA0004:T1548"
@@ -1941,7 +1941,7 @@
     "description": "Detect root suid process crashing",
     "label": "Suspicious suid process crash",
     "behaviors": [
-      "linux:exploitation"
+      "linux:exploit"
     ],
     "mitre_attacks": [
       "TA0004:T1548"
@@ -2960,7 +2960,7 @@
   },
   "crowdsecurity/iptables-scan-multi_ports": {
     "name": "crowdsecurity/iptables-scan-multi_ports",
-    "description": "ban IPs that are scanning us",
+    "description": "Detect TCP scan on multiple ports",
     "label": "TCP Port Scan",
     "behaviors": [
       "tcp:scan"
@@ -3710,9 +3710,7 @@
     "name": "crowdsecurity/CVE-2022-30190-msdt",
     "description": "Detect CVE-2022-30190 from sysmon events",
     "label": "CVE-2022-30190",
-    "behaviors": [
-      "windows:rce"
-    ],
+    "behaviors": [],
     "mitre_attacks": [
       "TA0002:T1059",
       "TA0002:T1203"
@@ -3788,8 +3786,8 @@
   },
   "firewallservices/pf-scan-multi_ports": {
     "name": "firewallservices/pf-scan-multi_ports",
-    "description": "ban IPs that are scanning us",
-    "label": "PF Scan Multi Ports",
+    "description": "Detect TCP scan on multiple ports",
+    "label": "TCP Port Scan",
     "behaviors": [
       "tcp:scan"
     ],