Branch was auto-updated.

.github/workflows/detection-testing.yml

@@ -50,6 +50,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
       
 
@@ -137,6 +139,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2
@@ -194,6 +198,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -8,7 +8,7 @@ datamodel: []
 description: This search detects when an excessive number of authentication failures
   occur this search also includes attempts against MFA prompt codes
 search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
-  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod 
+  | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod 
   values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
   | where count > 10 
   | `security_content_ctime(firstTime)` 

detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml

@@ -0,0 +1,62 @@
+name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
+id: 114c6bfe-9406-11ec-bcce-acde48001122
+version: 1
+date: '2022-02-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser`
+  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
+  As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser 
+  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
+  Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
+references:
+- https://attack.mitre.org/techniques/T1558/004/
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 60
+  confidence: 90 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$

detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml

@@ -0,0 +1,58 @@
+name: Disabled Kerberos Pre-Authentication Discovery With PowerView
+id: b0b34e2c-90de-11ec-baeb-acde48001122
+version: 1
+date: '2022-02-18'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser`
+  is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks.
+  As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired`
+  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
+  Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
+search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use PowerView for troubleshooting
+references:
+- https://attack.mitre.org/techniques/T1558/004/
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 60
+  confidence: 90 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$

detections/endpoint/eventvwr_uac_bypass.yml

@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - IcedID
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml

@@ -1,8 +1,8 @@
 name: Excessive number of distinct processes created in Windows Temp folder
 id: 23587b6a-c479-11eb-b671-acde48001122
-version: 1
-date: '2021-06-03'
-author: Michael Hart, Splunk
+version: 2
+date: '2022-02-28'
+author: Michael Hart, Mauricio Velazco, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
@@ -13,7 +13,7 @@ description: This analytic will identify suspicious series of process executions
   to typical application behaviors that use Windows\Temp.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   distinct_count(Processes.process) as distinct_process_count  min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path
   = "*\\Windows\\Temp\\*" by Processes.dest Processes.user  _time span=20m | where
   distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter`'

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -1,26 +1,30 @@
 name: Kerberoasting spn request with RC4 encryption
 id: 5cc67381-44fa-4111-8a37-7a230943f027
-version: 3
-date: '2020-10-16'
-author: Jose Hernandez, Patrick Bareiss, Splunk
+version: 4
+date: '2022-02-09'
+author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: This search detects a potential kerberoasting attack via service principal
-  name requests
-search: '`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17
+description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
+ against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
+ attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field
+ based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options.
+search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id,
   Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `kerberoasting_spn_request_with_rc4_encryption_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  and include the windows security event logs that contain kerberos
-known_false_positives: Older systems that support kerberos RC4 by default NetApp may
-  generate false positives
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: Older systems that support kerberos RC4 by default like NetApp may
+  generate false positives. Filter as needed
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md
 - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Active Directory Kerberos Attacks
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
@@ -31,15 +35,15 @@ tags:
   - Source:Endpoint
   - Stage:Credential Access
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
   impact: 90
   kill_chain_phases:
   - Privilege Escalation
   message: Potential kerberoasting attack via service principal name requests detected
     on $dest$
   mitre_attack_id:
-  - T1558.003
   - T1558
+  - T1558.003
   nist:
   - DE.CM
   observable:

detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml

@@ -0,0 +1,59 @@
+name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
+id: 0cb847ee-9423-11ec-b2df-acde48001122
+version: 1
+date: '2022-02-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic leverages Windows Security Event 4738, `A user account was changed`,
+  to identify a change performed on a domain user object that disables Kerberos Pre-Authentication.
+  Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute
+  force attack against the user's password offline leveraging the ASP REP Roasting technique.
+  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
+  or a way to escalate privileges.
+search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*"
+| table EventCode, Account_Name, Security_ID, MSADChangedAttributes
+| `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events. The Advanced Security Audit policy setting
+  `User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: Unknown.
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+  kill_chain_phases:
+  - Intrusion
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Account_Name
+  - Security_ID
+  - MSADChangedAttributes
+  security_domain: endpoint
+  impact: 50
+  confidence: 90 
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
+  message: Kerberos Pre Authentication was Disabled for $Account_Name$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml

@@ -0,0 +1,57 @@
+name: Kerberos Pre-Authentication Flag Disabled with PowerShell
+id: 59b51620-94c9-11ec-b3d5-acde48001122
+version: 1
+date: '2022-02-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl`
+  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
+  As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account.
+  With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to
+  to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique.
+  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
+  or a way to escalate privileges.
+search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes.
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
+  kill_chain_phases:
+  - Intrusion
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 90 
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
+  message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml

@@ -0,0 +1,70 @@
+name: Mimikatz PassTheTicket CommandLine Parameters
+id: 13bbd574-83ac-11ec-99d4-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. 
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" 
+  OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
+references:
+- https://github.com/gentilkiwi/mimikatz
+- https://attack.mitre.org/techniques/T1550/003/  
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/rubeus_command_line_parameters.yml

@@ -0,0 +1,78 @@
+name: Rubeus Command Line Parameters
+id: cca37478-8377-11ec-b59a-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs 
+  MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets,
+  forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks.
+  Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" 
+  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" 
+  OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" 
+  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*"
+  OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
+references:
+- https://github.com/GhostPack/Rubeus 
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ 
+- https://attack.mitre.org/techniques/T1550/003/ 
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550
+  - T1550.003
+  - T1558
+  - T1558.003
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Rubeus command line parameters were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process

detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml

@@ -0,0 +1,71 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+id: 5ed8c50a-8869-11ec-876f-acde48001122
+version: 1
+date: '2022-02-07'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior
+  when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by
+  obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks.
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
+search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
+  (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND 
+  SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND
+  SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
+  SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
+  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
+how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
+  includes EventCode 10. This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment.
+known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
+references:
+- https://github.com/GhostPack/Rubeus
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
+- https://attack.mitre.org/techniques/T1550/003/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1550
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Winlogon.exe was accessed by $SourceImage$ on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: TargetImage
+    type: Process
+    role:
+    - Target

detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml

@@ -48,6 +48,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml

@@ -56,6 +56,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -66,6 +67,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Privilege Escalation
+  - Active Directory Kerberos Attacks
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:

detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml

@@ -0,0 +1,63 @@
+name: Windows Eventvwr UAC Bypass
+id: 66adff66-90d9-11ec-aba7-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: None known at this time. 
+references:
+-  https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - IcedID
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - event_id
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  security_domain: endpoint
+  impact: 80
+  confidence: 100 
+  risk_score: 80
+  risk_severity: high
+  context: 
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 14

detections/endpoint/suspicious_linux_discovery_commands.yml

@@ -0,0 +1,59 @@
+name: Suspicious Linux Discovery Commands
+id: 0edd5112-56c9-11ec-b990-acde48001122
+version: 1
+date: '2021-12-06'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\
+  
+  The search logic specifically looks for high number of distinct commands run in a short period of time. 
+search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
+  Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
+known_false_positives: Unless an administrator is using these commands to troubleshoot
+  or audit a system, the execution of these commands should be monitored.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+- https://attack.mitre.org/techniques/T1059/004/
+- https://github.com/IvanGlinkin/AutoSUID
+- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
+- https://github.com/rebootuser/LinEnum
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Suspicious Linux Discovery Commands detected on $dest$
+  mitre_attack_id:
+  - T1059.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.user 
+  - Processes.process_name
+  risk_score: 81
+  security_domain: endpoint

detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml

@@ -0,0 +1,68 @@
+name: Unusual Number of Kerberos Service Tickets Requested
+id: eb3e6702-8936-11ec-98fe-acde48001122
+version: 1
+date: '2022-02-08'
+author: Mauricio Velazco, Splunk
+type: Anomaly
+datamodel: []
+description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
+ against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
+ attempt to crack them offline allowing them to obtain privileged access to the domain.\
+ 
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this
+ analytic, users can try different combinations of the `bucket` span time and the
+ calculation of the `upperBound` field. 
+search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17
+| bucket span=2m _time
+| stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address
+| eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std by Client_Address
+| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
+| search isOutlier=1
+| `unusual_number_of_kerberos_service_tickets_requested_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: An single endpoint requesting a large number of kerberos service
+  tickets is not common behavior. Possible false positive scenarios include but are
+  not limited to vulnerability scanners, administration systems and missconfigured
+  systems.
+references:
+- https://attack.mitre.org/techniques/T1558/003/
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting 
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - Service_Name
+  - service_id
+  - Client_Address
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: 
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/wsreset_uac_bypass.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Living Off The Land 
   confidence: 90
   context:
   - Source:Endpoint

detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml

@@ -0,0 +1,56 @@
+name: Windows WSReset UAC Bypass
+id: 3118f0c2-90d9-11ec-b833-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: Unknown at this point in time.
+references:
+- https://github.com/hfiref0x/UACME
+- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass 
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63 
+  risk_severity: medium
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  message: 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 14

detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml

@@ -6,33 +6,37 @@ author: Xiao Lin, Splunk
 type: Anomaly
 datamodel:
 - Network_Traffic
-description: Insider might conduct information collection before data exfiltration,
-  and unusual volume of data download from internal server is an indicator of such
-  potential threat. This detection evaluates the total bytes downloaded from internal
-  servers at specific time window per entity level, and then flagged these that are
-  higher than 99.999% percentile as an anamaly. A behavior will be reported as long
-  as the downloaded byte volume is unusual even though that operation is benigh, which
-  causes false positive. It is therefore advised to adjust threshold and time window
-  based on detection performance whenever necessary. It should be noted that seasonality
-  is not modeled in the current approach.
-search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event,
-  "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope
-  = map_get(input_event, "src_device_scope") | eval dest_device_scope = map_get(input_event,
-  "src_device_scope") | where src_device_scope IS NOT NULL AND dest_device_scope IS
-  NOT NULL | eval dest_device = map_get(input_event, "dest_device_ips") | where dest_device
-  IS NOT NULL AND dest_device_scope == "INTERNAL" | eval src_device = map_get(input_event,
-  "source_device_ips") | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
-  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string",
-  null)) | where download_bytes IS NOT NULL | eval tenant = map_get(input_event, "_tenant"),
-  event_id = map_get(input_event, "event_id") | adaptive_threshold algorithm="quantile"
-  value="download_bytes" entity="dest_device" threshold=0.001 window=86400L | eval
-  end_time = timestamp | eval start_time = end_time - 86400 | eval body = create_map(["event_id",
-  event_id, "tenant", tenant]) | select start_time, end_time, dest_device, label,
-  body | into write_ssa_detected_events();'
-how_to_implement: Ingest PAN traffic logs
-known_false_positives: Benign large volume data download might be flagged as (false)
-  positive.
+description: Insider might conduct information collection before data exfiltration, and unusual volume of data
+  download from internal server is an indicator of such potential threat. This detection evaluates the total 
+  bytes downloaded from internal servers at specific time window per entity level, and then flagged these that 
+  are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte 
+  volume is unusual even though that operation is benign, which causes false positive. It is therefore advised 
+  to adjust threshold and time window based on detection performance whenever necessary. It should be noted that 
+  seasonality is not modeled in the current approach.
+search: '| from read_ssa_enriched_events() 
+  | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null)
+  | eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null))
+  | where sourcetype == "pan:traffic"
+  | eval src_device_scope =ucast(map_get(input_event, "src_device_scope"), "string", null)
+  | eval dest_device_scope=ucast(map_get(input_event, "dest_device_scope"), "string", null)
+  | where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL
+  | eval dest_device = ucast(map_get(input_event, "dest_device_ips"), "collection<string>", [])[0]
+  | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL"
+  | eval src_device  = ucast(map_get(input_event, "src_device_ips"), "collection<string>", [])[0]
+  | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
+  | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer", 0)
+  | eval download_bytes = cast(bytes_in, "double")
+  | eval tenant = ucast(map_get(input_event, "_tenant"), "string", null)
+  | eval event_id = ucast(map_get(input_event, "event_id"), "string", null)
+  | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" window=86400000L
+  | where label AND quantile>0.99999
+  | eval end_time = timestamp
+  | eval start_time = end_time - 86400000
+  | eval body = create_map(["event_id", event_id, "tenant", tenant])
+  | eval entities=mvappend(dest_device)
+  | into write_ssa_detected_events();'
+how_to_implement: Ingest PAN traffic logs 
+known_false_positives: Benign large volume data download might be flagged as (false) positive.
 references:
 - https://github.com/twitter/AnomalyDetection
 tags:

lookups/linux_tool_discovery_process.csv

@@ -0,0 +1,61 @@
+process
+cat /proc/version
+cat /etc/*-release
+/etc/passwd 
+cat /etc/*
+lastlog 
+id
+PermitRootLogin
+sestatus *
+ps
+mysql*
+netstat*
+find *
+head /var/mail/root
+docker
+cat /etc/issue
+cat /etc/*-release
+cat /proc/version
+uname -a
+uname -mrs
+rpm -q kernel
+dmesg | grep Linux
+ls /boot | grep vmlinuz-
+cat /etc/profile
+cat /etc/bashrc
+cat ~/.bash_profile
+cat ~/.bashrc
+cat ~/.bash_logout
+ps -aux | grep root
+ps -ef | grep root
+crontab -l
+cat /etc/cron*
+cat /etc/cron.allow
+cat /etc/cron.deny
+cat /etc/crontab
+grep -i user *
+grep -i pass *
+ifconfig
+cat /etc/network/interfaces
+cat /etc/sysconfig/network
+cat /etc/resolv.conf
+cat /etc/networks
+cvelist-file:*
+exploit-db*
+strings -e /etc/apache2/apache2.conf
+strings -e /etc/ssh/sshd_config
+strings -e /etc/shadow
+iptables -L
+lsof -i
+netstat -antup
+netstat -antpx
+netstat -tulpn
+arp -e
+route
+cat /etc/passwd
+cat /etc/group
+cat /etc/shadow
+find / -perm -u=s
+find / -perm -g=s
+find / -perm -4000
+find / -perm -2000

lookups/linux_tool_discovery_process.yml

@@ -0,0 +1,7 @@
+description: A list of suspicious bash commonly used by attackers via scripts
+filename: linux_tool_discovery_process.csv
+name: linux_tool_discovery_process
+default_match: 'false'
+match_type: WILDCARD(process)
+min_matches: 1
+case_sensitive_match: 'false'

lookups/ransomware_extensions.csv

@@ -28,7 +28,6 @@ Extensions,Name
 .bitstak,BitStak
 .Silent,BlackShades Crypter
 .blocatto,Blocatto
-.lock,Brazilian
 .cry,Central Security Treatment Organization
 .cerber,Cerber
 .cerber2,Cerber
@@ -299,4 +298,4 @@ Extensions,Name
 .FUSION,Fusion
 .MILIHPEN,Milihpen
 .GANGBANG,Gangbang
-.reddot,RedDot
+.reddot,RedDot

playbooks/activedirectory_reset_password.yml

@@ -12,6 +12,7 @@ app_list:
 - "LDAP"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - compromisedUserName
   product:

playbooks/aws_disable_user_accounts.yml

@@ -14,6 +14,7 @@ app_list:
 tags:
   platform_tags:
   - Cloud
+  playbook_type: Input
   playbook_fields:
   - aws_username
   product:

playbooks/aws_find_inactive_users.yml

@@ -15,6 +15,7 @@ app_list:
 tags:
   platform_tags:
   - Cloud
+  playbook_type: Automation
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/block_indicators.yml

@@ -14,6 +14,7 @@ app_list:
 - "OpenDNS Umbrella"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - destinationDnsDomain
   - destinationAddress

playbooks/crowdstrike_malware_triage.yml

@@ -12,6 +12,7 @@ app_list:
 - "Crowdstrike OAuth"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - filePath
   - destinationAddress

playbooks/custom_functions/container_merge.json

@@ -1,6 +1,6 @@
 {
-    "create_time": "2021-10-18T12:31:32.500833+00:00",
-    "custom_function_id": "83776ecf4dd52c71d8497cb500dd332780eb9c72",
+    "create_time": "2022-02-25T14:52:47.172543+00:00",
+    "custom_function_id": "1f8ae8e7978b750272fbbaba5efe4e6127a9a6a7",
     "description": "An alternative to the add-to-case API call. This function will copy all artifacts, automation, notes and comments over from every container within the container_list into the target_container. The target_container will be upgraded to a case.\n\nThe notes will be copied over with references to the child containers from where they came. A note will be left in the child containers with a link to the target container. The child containers will be marked as evidence within the target container. \n\nAny notes left as a consequence of the merge process will be skipped in subsequent merges.",
     "draft_mode": false,
     "inputs": [
@@ -36,6 +36,6 @@
         }
     ],
     "outputs": [],
-    "platform_version": "5.0.1.66250",
+    "platform_version": "5.2.1.78411",
     "python_version": "3"
 }

playbooks/custom_functions/container_merge.py

@@ -162,7 +162,7 @@ def container_merge(target_container=None, container_list=None, workbook=None, c
     # Fetch any previous merge note
     params = {'_filter_container': '"{}"'.format(container['id']), '_filter_title': '"[Auto-Generated] Child Containers"'}
     note_url = phantom.build_phantom_rest_url('note')
-    response_data = phantom.requests.get(note_url, verify=False).json()
+    response_data = phantom.requests.get(note_url, params=params, verify=False).json()
     # If an old note was found, proceed to overwrite it
     if response_data['count'] > 0:
         note_item = response_data['data'][0]

playbooks/custom_functions/find_related_containers.json

@@ -1,6 +1,6 @@
 {
-    "create_time": "2021-10-07T15:52:23.940165+00:00",
-    "custom_function_id": "24c4ef5ecd259674a07cd3c747f4223f09b5dd8f",
+    "create_time": "2022-02-10T18:24:50.244936+00:00",
+    "custom_function_id": "5781e3d5a4773b2c48afd429768fd81b5e733e54",
     "description": "Takes a provided list of indicator values to search for and finds all related containers. It will produce a list of the related container details.",
     "draft_mode": false,
     "inputs": [
@@ -113,6 +113,6 @@
             "description": "Link to container"
         }
     ],
-    "platform_version": "5.0.1.66250",
+    "platform_version": "5.2.1.78411",
     "python_version": "3"
 }

playbooks/custom_functions/find_related_containers.py

@@ -96,7 +96,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
         filter_in_case = True
     
     # If value list is equal to * then proceed to grab all indicator records for the current container
-    if isinstance(value_list, list) and value_list[0] == "*":
+    if value_list and (isinstance(value_list, list) and "*" in value_list) or (isinstance(value_list, str) and value_list == "*"):
         new_value_list = []
         url = phantom.build_phantom_rest_url('container', current_container, 'artifacts') + '?page_size=0'
         response_data = phantom.requests.get(uri=url, verify=False).json().get('data')
@@ -127,15 +127,10 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
     for indicator_id in list(set(indicator_id_list)):
         params = {'indicator_ids': indicator_id}
         response_data = phantom.requests.get(indicator_common_container_url, params=params, verify=False).json()
+        
         # Populate an indicator dictionary where the original ids are the dictionary keys and the                     
         # associated continers are the values
         if response_data:
-            # Quit early if no related containers were found
-            if len(response_data) == 1 and response_data[0].get('container_id') == current_container:
-                phantom.debug(f"No related containers found for provided values: '{value_list}'")
-                assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
-                return outputs
-            
             indicator_id_dictionary[str(indicator_id)] = []
             for item in response_data:
                 # Append all related containers except for current container
@@ -167,8 +162,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
 
             # Gather container data
             params = {'page_size': 0}
-            if offset_time:
-                params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"'
+            params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"'
             containers_response = phantom.requests.get(uri=container_url, params=params, verify=False).json()
             all_container_dictionary = {}
             if containers_response['count'] > 0:

playbooks/delete_detected_files.yml

@@ -16,6 +16,7 @@ tags:
   detections:
   - Executable File Written in Administrative SMB Share
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - filePath
   - destinationAddress

playbooks/email_notification_for_malware.yml

@@ -15,6 +15,7 @@ app_list:
 - "SMTP"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - fileHash
   - vaultId

playbooks/internal_host_splunk_investigate_log4j.yml

@@ -15,6 +15,7 @@ tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
   platform_tags: []
+  playbook_type: Input
   playbook_fields:
   - hostName
   - destinationAddress

playbooks/internal_host_ssh_investigate.yml

@@ -12,6 +12,7 @@ app_list:
 - "SSH"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/internal_host_ssh_log4j_investigate.yml

@@ -12,6 +12,7 @@ app_list:
 - "SSH"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/internal_host_ssh_log4j_respond.yml

@@ -12,6 +12,7 @@ app_list:
 - "SSH"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/internal_host_winrm_investigate.yml

@@ -12,6 +12,7 @@ app_list:
 - "Windows Remote Management"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/internal_host_winrm_log4j_investigate.yml

@@ -12,6 +12,7 @@ app_list:
 - "Windows Remote Management"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/internal_host_winrm_log4j_respond.yml

@@ -12,6 +12,7 @@ app_list:
 - "Windows Remote Management"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/log4j_investigate.yml

@@ -30,5 +30,6 @@ tags:
   - Log4Shell JNDI Payload Injection with Outbound Connection
   - Detect Outbound LDAP Traffic
   playbook_fields: []
+  playbook_type: Automation
   product:
   - Splunk SOAR

playbooks/log4j_respond.yml

@@ -30,5 +30,6 @@ tags:
   - Log4Shell JNDI Payload Injection with Outbound Connection
   - Detect Outbound LDAP Traffic
   playbook_fields: []
+  playbook_type: Automation
   product:
   - Splunk SOAR

playbooks/malware_hunt_and_contain.yml

@@ -15,6 +15,7 @@ app_list:
 - "VirusTotal"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - fileHash
   product:

playbooks/ransomware_investigate_and_contain.yml

@@ -22,6 +22,7 @@ tags:
   - Conti Common Exec parameter
   platform_tags:
   - Ransomware
+  playbook_type: Automation
   playbook_fields:
   - ComputerName
   - Username

playbooks/risk_notable_block_indicators.yml

@@ -18,6 +18,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:

playbooks/risk_notable_enrich.yml

@@ -17,6 +17,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:

playbooks/risk_notable_import_data.yml

@@ -34,6 +34,7 @@ tags:
   - note_content
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   playbook_fields:
   - event_id
   - info_min_time

playbooks/risk_notable_investigate.yml

@@ -14,6 +14,7 @@ app_list:
 tags:
   labels:
   - risk_notable
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:

playbooks/risk_notable_merge_events.yml

@@ -17,6 +17,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:

playbooks/risk_notable_mitigate.yml

@@ -13,6 +13,7 @@ app_list:
 tags:
   labels:
   - risk_notable
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:

playbooks/risk_notable_preprocess.yml

@@ -20,6 +20,7 @@ tags:
   - risk_notable
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   playbook_fields:
   - event_id
   - info_min_time

playbooks/risk_notable_protect_assets_and_users.yml

@@ -16,6 +16,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:

playbooks/risk_notable_review_indicators.yml

@@ -15,5 +15,6 @@ tags:
   - risk_notable
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   product:
   - Splunk SOAR

playbooks/risk_notable_verdict.yml

@@ -15,5 +15,6 @@ tags:
   - risk_notable
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   product:
   - Splunk SOAR

playbooks/start_investigation.yml

@@ -12,5 +12,6 @@ app_list: []
 tags:
   platform_tags: []
   playbook_fields: []
+  playbook_type: Automation
   product:
   - Splunk SOAR

playbooks/threat_intel_investigate.yml

@@ -13,6 +13,7 @@ app_list: []
 tags:
   platform_tags:
   - threat_intel
+  playbook_type: Automation
   playbook_fields: []
   product:
   - Splunk SOAR

playbooks/trustar_enrich_indicators.yml

@@ -15,6 +15,7 @@ tags:
   platform_tags:
   - threat_intel
   - risk_notable
+  playbook_type: Input
   playbook_fields: 
   - indicators
   product:

stories/active_directory_kerberos_attacks.yml

@@ -0,0 +1,34 @@
+name: Active Directory Kerberos Attacks
+id: 38b8cf16-8461-11ec-ade1-acde48001122
+version: 1
+date: '2022-02-02'
+author: Mauricio Velazco, Splunk
+description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
+narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and
+ users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access
+ to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since
+ the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases 
+ of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\
+ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in 
+ Kerberos based attacks.
+references:
+- https://en.wikipedia.org/wiki/Kerberos_(protocol)
+- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+- https://attack.mitre.org/techniques/T1558/003/
+- https://attack.mitre.org/techniques/T1550/003/
+- https://attack.mitre.org/techniques/T1558/004/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Lateral Movement
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/linux_post_exploitation.yml

@@ -0,0 +1,19 @@
+name: Linux Post-Exploitation
+id: d310ccfe-5477-11ec-ad05-acde48001122
+version: 1
+date: '2021-12-03'
+author: Rod Soto
+description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.
+narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml

@@ -0,0 +1,15 @@
+name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser Unit Test
+tests:
+- name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
+  file: endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
+
+
+

tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml

@@ -0,0 +1,12 @@
+name: Disabled Kerberos Pre-Authentication Discovery With PowerView Unit Test
+tests:
+- name: Disabled Kerberos Pre-Authentication Discovery With PowerView
+  file: endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml

@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: True

tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml

@@ -0,0 +1,13 @@
+name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl Unit Test
+tests:
+- name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
+  file: endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True

tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml

@@ -0,0 +1,13 @@
+name: Kerberos Pre-Authentication Flag Disabled with PowerShell Unit Test
+tests:
+- name: Kerberos Pre-Authentication Flag Disabled with PowerShell
+  file: endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
+    update_timestamp: True

tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml

@@ -0,0 +1,12 @@
+name: Mimikatz PassTheTicket CommandLine Parameters Unit Test
+tests:
+- name: Mimikatz PassTheTicket CommandLine Parameters
+  file: endpoint/mimikatz_passtheticket_commandline_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rubeus_command_line_parameters.test.yml

@@ -0,0 +1,12 @@
+name: Rubeus Command Line Parameters Unit Test
+tests:
+- name: Rubeus Command Line Parameters
+  file: endpoint/rubeus_command_line_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml

@@ -0,0 +1,12 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access Unit Test
+tests:
+- name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+  file: endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml

@@ -0,0 +1,10 @@
+name: Windows Eventvwr UAC Bypass Unit Test
+tests:
+- name: Windows Eventvwr UAC Bypass
+  file: endpoint/ssa___windows_eventvwr_uac_bypass.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon-registry.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_linux_discovery_commands.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Linux Discovery Commands
+tests:
+- name: Suspicious Linux Discovery Commands
+  file: endpoint/suspicious_linux_discovery_commands.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-60d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux

tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml

@@ -0,0 +1,12 @@
+name: Unusual Number of Kerberos Service Tickets Requested Unit Test
+tests:
+- name: Unusual Number of Kerberos Service Tickets Requested
+  file: endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog