Branch was auto-updated.

detections/endpoint/windows_high_file_deletion_frequency.yml

@@ -33,6 +33,7 @@ tags:
   - Swift Slicer
   - Data Destruction
   - WhisperGate
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 80
   impact: 90

detections/endpoint/windows_system_shutdown_commandline.yml

@@ -1,22 +1,25 @@
 name: Windows System Shutdown CommandLine
 id: 4fee57b8-d825-4bf3-9ea8-bf405cdb614c
-version: 1
-date: '2022-07-27'
+version: 2
+date: '2023-06-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic identifies Windows commandline to shutdown a windows
-  host machine. This technique was seen in several APT, RAT like dcrat and other commodity
-  malware to shutdown the machine to add more impact, interrupt access, aid destruction
-  of the system like wiping disk or inhibit system recovery. This TTP is a good pivot
-  to check why application trigger this commandline which is not so common way to
-  shutdown a machine.
+description: This detection rule is designed to identify the execution of the Windows shutdown command via command line interface. 
+  The shutdown command can be utilized by system administrators to properly halt, power off, or reboot a computer. 
+  However, in a security context, attackers who have gained unauthorized access to a system may also use this command in an effort to erase tracks, 
+  or to cause disruption and denial of service. In some instances, they might execute the shutdown command after installing a backdoor, 
+  to force the system to restart, ensuring that changes take effect or evading detection by security tools. 
+  Monitoring for the use of the Windows shutdown command, especially in conjunction with other unusual or unauthorized activities, 
+  can be an important part of identifying malicious behavior within a network. 
+  It is advised that security professionals analyze the context in which the shutdown command is being executed to differentiate between 
+  legitimate administrative functions and potentially malicious activity.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
-  Processes.process="*shutdown*" Processes.process="* /s*" Processes.process="* /t*"
+  Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*", "* /r*", "* -r*") AND Processes.process="* /t*"
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -34,6 +37,7 @@ references:
 tags:
   analytic_story:
   - DarkCrystal RAT
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 70
   impact: 70