From 18a9043ff189675eff1cf67f0281e60ba31070d1 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Tue, 25 Jan 2022 16:12:04 -0800
Subject: [PATCH 01/52] added data model to searches

---
 .../endpoint/detect_autosuid_post_exploitation_tool.yml   | 8 +++++---
 detections/endpoint/detect_linenum_execution.yml          | 8 +++++---
 detections/endpoint/detect_linpeas_execution.yml          | 8 ++++----
 .../endpoint/detect_linux_exploit_suggester_execution.yml | 6 +++---
 detections/endpoint/detect_mimipenguin.yml                | 7 ++++---
 5 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
index 32a52632b2..47519d6dd3 100644
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
@@ -8,9 +8,11 @@ datamodel:
 - Endpoint
 description: This search, detects Linux post exploitation tool AutoSUID, which is
   an a tool that searches for SUID executables files in order to escalate privileges.
-search: ' `sysmon_linux` CommandLine="find / -xdev -user root ( -perm -4000 -o -perm
-  -2000 -o -perm -6000 )" | stats count by Computer process process_current_directory
-  process_path | `detect_autosuid_post_exploitation_tool_filter`'
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_autosuid_post_exploitation_tool_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
index cea9fb1517..0f4807c25b 100644
--- a/detections/endpoint/detect_linenum_execution.yml
+++ b/detections/endpoint/detect_linenum_execution.yml
@@ -10,9 +10,11 @@ description: LinEnum is a bash script that performs discovery commands for accou
   processes, kernel version, applications, services, and uses the information from
   these commands to present operator with ways of escalating privileges or further
   exploitation of targeted host.
-search: ' `sysmon_linux` CommandLine="grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
-  | stats count by Computer CommandLine user process_exec process_current_directory
-  | `detect_linenum_execution_filter` '
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where Processes.process = "grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
+    by Processes.dest Processes.user Processes.parent_process_name Processes.process_current_directory
+    Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | | `detect_linenum_execution_filter` '
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Very rare to perform such an extensive grep on a system, however
diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml
index 527ab77df7..e4863682bf 100644
--- a/detections/endpoint/detect_linpeas_execution.yml
+++ b/detections/endpoint/detect_linpeas_execution.yml
@@ -2,15 +2,15 @@ name: Detect LinPeas Execution
 id: 4ea6fa10-547c-11ec-a4f9-acde48001122
 version: 1
 date: '2021-12-03'
-author: Rod Soto
+author: Rod Soto, Eric McGinnis
 type: TTP
 datamodel:
 - Endpoint
 description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script
   that searches for possible paths to escalate privileges.
-search: ' `sysmon_linux` CommandLine!=null parent_process_exec=sudo OR parent_process_exec=bash
-  OR CommandLine="cve-list" | stats count by Computer CommandLine user parent_process_exec
-  process_path | `detect_linpeas_execution_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process= "grep -Ev ._history.|.bashrc|.bluemix|.cer|.cloudflared|.crt|.csr|.db|.der|.env|.erlang.cookie|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.pem|.pfx|.pgp|.plan|.profile|.pypirc|.rdg|.recently-used.xbel|.rhosts|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.timer|.vault-token|.viminfo|.vnc|.wgetrc" OR Processes.process="find /var/log/ /private/var/log -type f -exec grep -R -a -E -o (25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) {} ;" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `detect_linpeas_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: This search may produce false positives as it will display
diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
index 44c9b56699..6d11f54685 100644
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
@@ -9,9 +9,9 @@ datamodel:
 description: This search detects Linux Exploit Suggester tool execution. This is a
   tool that searches for vulnerabilities based on Kernel and Distribution versions
   then queries public exploit databases.
-search: ' `sysmon_linux` CommandLine="cvelist-file:" OR CommandLine="uname -a" OR
-  CommandLine="*exploit*" OR CommandLine="*exploit-db*"  | stats count by CommandLine,user,Computer,action,signature,
-  process_name | `detect_linux_exploit_suggester_execution_filter`'
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="uname -a" OR Processes.process="cvelist-file:*" OR Processes.process="*exploit*" OR Processes.process="*exploit-db*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_linux_exploit_suggester_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Monitoring tools may produce similar commands although the
diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml
index 50dcd97758..ca58d97f34 100644
--- a/detections/endpoint/detect_mimipenguin.yml
+++ b/detections/endpoint/detect_mimipenguin.yml
@@ -8,9 +8,10 @@ datamodel:
 - Endpoint
 description: MimiPenguin is a tool that dumps login passwords from current linux destop
   users. This search detects execution of this tool.
-search: ' `sysmon_linux` CommandLine="strings -e /etc/apache2/apache2.conf" OR CommandLine="strings
-  -e /etc/ssh/sshd_config" OR CommandLine="strings -e /etc/shadow"  | stats count
-  by Computer parent_process process_current_directory user CommandLine | `detect_mimipenguin_filter`'
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process="strings -e /etc/apache2/apache2.conf" OR Processes.process="strings -e /etc/ssh/sshd_config" OR Processes.process="strings -e /etc/shadow" by Processes.dest 
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimipenguin_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Some of these commands may be executed by sysadmin however

From dd7477c38d1396a784c64d60d2dd60c90122ad80 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Tue, 25 Jan 2022 16:32:00 -0800
Subject: [PATCH 02/52] fixed space before pipe

---
 .../endpoint/detect_autosuid_post_exploitation_tool.yml       | 2 +-
 detections/endpoint/detect_linenum_execution.yml              | 4 ++--
 .../endpoint/detect_linux_exploit_suggester_execution.yml     | 2 +-
 detections/endpoint/detect_mimipenguin.yml                    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
index 47519d6dd3..0e35feffbf 100644
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: This search, detects Linux post exploitation tool AutoSUID, which is
   an a tool that searches for SUID executables files in order to escalate privileges.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )"
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
index 0f4807c25b..9325ac2d27 100644
--- a/detections/endpoint/detect_linenum_execution.yml
+++ b/detections/endpoint/detect_linenum_execution.yml
@@ -10,11 +10,11 @@ description: LinEnum is a bash script that performs discovery commands for accou
   processes, kernel version, applications, services, and uses the information from
   these commands to present operator with ways of escalating privileges or further
   exploitation of targeted host.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where Processes.process = "grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
     by Processes.dest Processes.user Processes.parent_process_name Processes.process_current_directory
     Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | | `detect_linenum_execution_filter` '
+    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `detect_linenum_execution_filter` '
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
   Need to install this add-on to parse fields correctly and execute detection search.
 known_false_positives: Very rare to perform such an extensive grep on a system, however
diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
index 6d11f54685..b7d34df51b 100644
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search detects Linux Exploit Suggester tool execution. This is a
   tool that searches for vulnerabilities based on Kernel and Distribution versions
   then queries public exploit databases.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process="uname -a" OR Processes.process="cvelist-file:*" OR Processes.process="*exploit*" OR Processes.process="*exploit-db*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_linux_exploit_suggester_execution_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml
index ca58d97f34..fc82708395 100644
--- a/detections/endpoint/detect_mimipenguin.yml
+++ b/detections/endpoint/detect_mimipenguin.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: MimiPenguin is a tool that dumps login passwords from current linux destop
   users. This search detects execution of this tool.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process="strings -e /etc/apache2/apache2.conf" OR Processes.process="strings -e /etc/ssh/sshd_config" OR Processes.process="strings -e /etc/shadow" by Processes.dest 
   Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimipenguin_filter`'

From b095a626819d2be94ca84de6b4f9fb73b9448b07 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 26 Jan 2022 13:44:57 -0800
Subject: [PATCH 03/52] minor upddates

---
 ...detect_autosuid_post_exploitation_tool.yml | 20 +++++++++++--------
 .../endpoint/detect_linenum_execution.yml     | 15 +++++++++-----
 .../endpoint/detect_linpeas_execution.yml     | 16 +++++++++------
 ...tect_linux_exploit_suggester_execution.yml |  4 ++--
 4 files changed, 34 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
index 0e35feffbf..018d575224 100644
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
@@ -26,20 +26,19 @@ tags:
   automated_detection_testing: passed
   confidence: 90
   context:
-  - Source: Endpoint
-  - Stage: Discovery
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
   impact: 90
   kill_chain_phases:
   - Exploitation
-  - Privilege Escalation
-  message: AutoSUID post exploitation tool detected
+  message: AutoSUID post exploitation tool detected on $dest$
   mitre_attack_id:
   - T1069
   - T1222
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
@@ -49,9 +48,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Computer
+  - dest
+  - user
   - process
-  - process_path
-  - process_current_directory
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
index 9325ac2d27..2e86488d62 100644
--- a/detections/endpoint/detect_linenum_execution.yml
+++ b/detections/endpoint/detect_linenum_execution.yml
@@ -36,7 +36,7 @@ tags:
   impact: 50
   kill_chain_phases:
   - Privilege Escalation
-  message: LinEnum post exploitation tool detected
+  message: LinEnum post exploitation tool detectedonn $dest$
   mitre_attack_id:
   - T1087
   - T1069
@@ -47,7 +47,7 @@ tags:
   - T1016
   - T1033
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
@@ -57,9 +57,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - CommandLine
+  - dest
   - user
-  - process_exec
-  - process_current_directory
+  - process
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
   risk_score: 45
   security_domain: endpoint
diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml
index e4863682bf..1a7ee0715c 100644
--- a/detections/endpoint/detect_linpeas_execution.yml
+++ b/detections/endpoint/detect_linpeas_execution.yml
@@ -33,7 +33,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   - Privilege Escalation
-  message: LinPEAS post exploitation tool detected
+  message: LinPEAS post exploitation tool detected on $dest$
   mitre_attack_id:
   - T1082
   - T1083
@@ -44,7 +44,7 @@ tags:
   - T1518
   - T1033
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
@@ -54,10 +54,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Computer
-  - CommandLine
+  - dest
   - user
-  - parent_process_exec
-  - process_path
+  - process
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
index b7d34df51b..3194022906 100644
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
@@ -25,8 +25,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: endpoint
-  - Stage: discovery
+  - Source:Endpoint
+  - Stage:Discovery
   dataset:
   - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
   impact: 90

From 3d3638c2e40be2038db71f89f9715025db23e5cd Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 26 Jan 2022 14:20:54 -0800
Subject: [PATCH 04/52] story file

---
 macros/sysmon_linux.yml             | 4 ----
 stories/linux_post_exploitation.yml | 2 +-
 2 files changed, 1 insertion(+), 5 deletions(-)
 delete mode 100644 macros/sysmon_linux.yml

diff --git a/macros/sysmon_linux.yml b/macros/sysmon_linux.yml
deleted file mode 100644
index 7482f5a592..0000000000
--- a/macros/sysmon_linux.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-definition: source=Syslog:Linux-Sysmon/Operational
-description: customer specific splunk configurations(eg- index, source, sourcetype).
-  Replace the macro definition with configurations for your Splunk Environmnent.
-name: sysmon_linux
diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml
index 9ca9a638bb..c6050f86f4 100644
--- a/stories/linux_post_exploitation.yml
+++ b/stories/linux_post_exploitation.yml
@@ -17,4 +17,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  usecase: Security Monitoring
+  usecase: Security Monitoring
\ No newline at end of file

From 328417d4fa6feb2ca2ca2fb878a85ae2c8c653e3 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 26 Jan 2022 14:31:04 -0800
Subject: [PATCH 05/52] test files

---
 .../detect_autosuid_post_exploitation_tool.test.yml  | 12 ++++++++++++
 tests/endpoint/detect_linenum_execution.test.yml     | 12 ++++++++++++
 tests/endpoint/detect_linpeas_execution.test.yml     | 12 ++++++++++++
 ...detect_linux_exploit_suggester_execution.test.yml | 12 ++++++++++++
 tests/endpoint/detect_mimipenguin.test.yml           | 12 ++++++++++++
 5 files changed, 60 insertions(+)
 create mode 100644 tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
 create mode 100644 tests/endpoint/detect_linenum_execution.test.yml
 create mode 100644 tests/endpoint/detect_linpeas_execution.test.yml
 create mode 100644 tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
 create mode 100644 tests/endpoint/detect_mimipenguin.test.yml

diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
new file mode 100644
index 0000000000..29c16b458d
--- /dev/null
+++ b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
@@ -0,0 +1,12 @@
+name: Detect AutoSUID post exploitation tool Unit Test
+tests:
+- name: Detect AutoSUID post exploitation tool
+  file: endpoint/detect_autosuid_post_exploitation_tool.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: autoSUID.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml
new file mode 100644
index 0000000000..85d7de99da
--- /dev/null
+++ b/tests/endpoint/detect_linenum_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect LinEnum execution unit Test
+tests:
+- name: Detect LinEnum execution
+  file: endpoint/detect_linenum_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: LinuxEnumd.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml
new file mode 100644
index 0000000000..1e7397a056
--- /dev/null
+++ b/tests/endpoint/detect_linpeas_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect LinPeas Execution Unit Test
+tests:
+- name: Detect LinPeas Execution
+  file: endpoint/detect_linpeas_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linpeasdataset.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
new file mode 100644
index 0000000000..1efcd32d23
--- /dev/null
+++ b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect Linux Exploit Suggester Execution Unit Test
+tests:
+- name: Detect Linux Exploit Suggester Execution
+  file: endpoint/detect_linux_exploit_suggester_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linuxexploitsuggesterdatasets.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml
new file mode 100644
index 0000000000..a2fff212b5
--- /dev/null
+++ b/tests/endpoint/detect_mimipenguin.test.yml
@@ -0,0 +1,12 @@
+name: Detect MimiPenguin Unit Test
+tests:
+- name: Detect MimiPenguin
+  file: endpoint/detect_mimipenguin.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: mimipenguin.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

From c076fbc6bea35eaadfd54f289e8259bb24da72ee Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 7 Feb 2022 18:52:34 -0500
Subject: [PATCH 06/52] adding analytic story and three new detections

---
 ...asting_spn_request_with_rc4_encryption.yml |  1 +
 ...z_passtheticket_commandline_parameters.yml | 68 ++++++++++++++++++
 .../rubeus_command_line_parameters.yml        | 72 +++++++++++++++++++
 ...ticket_exports_through_winlogon_access.yml | 67 +++++++++++++++++
 ...incipalnames_discovery_with_powershell.yml |  1 +
 ...ceprincipalnames_discovery_with_setspn.yml |  1 +
 stories/active_directory_kerberos_attacks.yml | 22 ++++++
 ...stheticket_commandline_parameters.test.yml | 12 ++++
 .../rubeus_command_line_parameters.test.yml   | 12 ++++
 ...t_exports_through_winlogon_access.test.yml | 12 ++++
 10 files changed, 268 insertions(+)
 create mode 100644 detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
 create mode 100644 detections/endpoint/rubeus_command_line_parameters.yml
 create mode 100644 detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
 create mode 100644 stories/active_directory_kerberos_attacks.yml
 create mode 100644 tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml
 create mode 100644 tests/endpoint/rubeus_command_line_parameters.test.yml
 create mode 100644 tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml

diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
index 70038db580..7ea40e6c1f 100644
--- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
+++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
@@ -21,6 +21,7 @@ references:
 tags:
   analytic_story:
   - Windows Privilege Escalation
+  - Active Directory Kerberos Attacks
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
new file mode 100644
index 0000000000..1dbe7a24d1
--- /dev/null
+++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
@@ -0,0 +1,68 @@
+name: Mimikatz PassTheTicket CommandLine Parameters
+id: 13bbd574-83ac-11ec-99d4-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. 
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" 
+  OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
+references:
+- https://github.com/gentilkiwi/mimikatz  
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
\ No newline at end of file
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
new file mode 100644
index 0000000000..54cc2d20ab
--- /dev/null
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -0,0 +1,72 @@
+name: Rubeus Command Line Parameters
+id: cca37478-8377-11ec-b59a-acde48001122
+version: 1
+date: '2022-02-01'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs 
+  MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets,
+  forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks.
+  Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" 
+  OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" 
+  OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" 
+  OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*"
+  OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
+references:
+- https://github.com/GhostPack/Rubeus  
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  message: Rubeus command line parameters were used on $dest$ 
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
\ No newline at end of file
diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
new file mode 100644
index 0000000000..2a13663144
--- /dev/null
+++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
@@ -0,0 +1,67 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+id: 5ed8c50a-8869-11ec-876f-acde48001122
+version: 1
+date: '2022-02-07'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior
+  when using the Rubeus tool to monitor for and export kerberos tickets from memory. Exporting tickets from memory is typically the first step for pass the ticket attacks.
+  Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
+  Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
+search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
+  (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND 
+  SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND
+  SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
+  SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
+  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
+how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
+  includes EventCode 10.exe. This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment.
+known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
+references:
+- https://github.com/GhostPack/Rubeus
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1550.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Winlogon.exe was accessed by $SourceImage$ on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: TargetImage
+    type: Process
+    role:
+    - Target
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
index ea52e4a955..63098b3965 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
@@ -48,6 +48,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
index 2f456df538..fbe2681a0c 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
@@ -66,6 +66,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Privilege Escalation
+  - Active Directory Kerberos Attacks
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:
diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml
new file mode 100644
index 0000000000..d261a896d8
--- /dev/null
+++ b/stories/active_directory_kerberos_attacks.yml
@@ -0,0 +1,22 @@
+name: Active Directory Kerberos Attacks
+id: 38b8cf16-8461-11ec-ade1-acde48001122
+version: 1
+date: '2022-02-02'
+author: Mauricio Velazco, Splunk
+description: UPDATE_DESCRIPTION
+narrative: UPDATE_NARRATIVE
+references:
+- https://www.destroyallsoftware.com/talks/wat
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Lateral Movement
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file
diff --git a/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml b/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml
new file mode 100644
index 0000000000..048ca7bf0c
--- /dev/null
+++ b/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml
@@ -0,0 +1,12 @@
+name: Mimikatz PassTheTicket CommandLine Parameters Unit Test
+tests:
+- name: Mimikatz PassTheTicket CommandLine Parameters
+  file: endpoint/mimikatz_passtheticket_commandline_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/rubeus_command_line_parameters.test.yml b/tests/endpoint/rubeus_command_line_parameters.test.yml
new file mode 100644
index 0000000000..8453ca23c7
--- /dev/null
+++ b/tests/endpoint/rubeus_command_line_parameters.test.yml
@@ -0,0 +1,12 @@
+name: Rubeus Command Line Parameters Unit Test
+tests:
+- name: Rubeus Command Line Parameters
+  file: endpoint/rubeus_command_line_parameters.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml b/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml
new file mode 100644
index 0000000000..d20b693254
--- /dev/null
+++ b/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml
@@ -0,0 +1,12 @@
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access Unit Test
+tests:
+- name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+  file: endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From e83767a9db50e8e2c0316c5b43ad259f4825261c Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 8 Feb 2022 14:24:15 -0500
Subject: [PATCH 07/52] adding missing references

---
 .../mimikatz_passtheticket_commandline_parameters.yml        | 4 +++-
 detections/endpoint/rubeus_command_line_parameters.yml       | 5 ++++-
 ...ubeus_kerberos_ticket_exports_through_winlogon_access.yml | 3 +++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
index 1dbe7a24d1..448da5f4e2 100644
--- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
+++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
@@ -21,7 +21,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   Sysmon TA.
 known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
 references:
-- https://github.com/gentilkiwi/mimikatz  
+- https://github.com/gentilkiwi/mimikatz
+- https://attack.mitre.org/techniques/T1550/003/  
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -30,6 +31,7 @@ tags:
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
+  - T1550
   - T1550.003
   product:
   - Splunk Enterprise
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index 54cc2d20ab..befe3f64e0 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -25,7 +25,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   Sysmon TA.
 known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
 references:
-- https://github.com/GhostPack/Rubeus  
+- https://github.com/GhostPack/Rubeus 
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ 
+- https://attack.mitre.org/techniques/T1550/003/ 
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -34,6 +36,7 @@ tags:
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
+  - T1550
   - T1550.003
   product:
   - Splunk Enterprise
diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
index 2a13663144..33fea11916 100644
--- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
@@ -25,6 +25,8 @@ how_to_implement: This search needs Sysmon Logs and a sysmon configuration, whic
 known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
 references:
 - https://github.com/GhostPack/Rubeus
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
+- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -34,6 +36,7 @@ tags:
   - Privilege Escalation
   - Lateral Movement
   mitre_attack_id:
+  - T1550
   - T1550.003
   product:
   - Splunk Enterprise

From 34f231e3a2b112367a47610a9e97bfe3ea89175a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 14 Feb 2022 13:51:34 -0800
Subject: [PATCH 08/52] version 1

---
 .../suspcious_linux_discovery_commands.yml    | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 detections/endpoint/suspcious_linux_discovery_commands.yml

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
new file mode 100644
index 0000000000..4404432843
--- /dev/null
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -0,0 +1,61 @@
+name: Suspcious Linux Discovery Commands
+id: 0edd5112-56c9-11ec-b990-acde48001122
+version: 1
+date: '2021-12-06'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search, detects Linux post exploitation tool AutoSUID, which is
+  an a tool that searches for SUID executables files in order to escalate privileges.
+search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where Processes.process
+    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","sudo*","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`| `suspcious_linux_discovery_commands_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/)
+  Please install this add-on to parse fields correctly and execute detection search.
+known_false_positives: Unless an administrator is using these commands to troubleshoot
+  or audit a system, the execution of these commands should be monitored.
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+- https://github.com/IvanGlinkin/AutoSUID
+tags:
+  analytic_story:
+  - Linux Post-Exploitation
+  automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: Suspcious Linux Discovery Commands detected on $dest$
+  mitre_attack_id:
+  - T1059.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - user
+  - process
+  - parent_process_name
+  - user 
+  - process_name
+  - process_id 
+  - parent_process_id 
+  - process_guid
+  risk_score: 81
+  security_domain: endpoint

From c521d07f7d05938f58102d585c043c9883738d87 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 14 Feb 2022 14:59:36 -0800
Subject: [PATCH 09/52] file updates

---
 .../suspcious_linux_discovery_commands.yml    | 28 ++++++++-----------
 ...uspcious_linux_discovery_commands.test.yml |  0
 2 files changed, 12 insertions(+), 16 deletions(-)
 create mode 100644 tests/endpoint/suspcious_linux_discovery_commands.test.yml

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index 4404432843..e05e41eee2 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -6,21 +6,22 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search, detects Linux post exploitation tool AutoSUID, which is
-  an a tool that searches for SUID executables files in order to escalate privileges.
+description: This search, detects execution of high number of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of vulnerable directories, executables and file permissions on a Linux host. The search logic specifically looks for high number of distinct commands run in a short period of time. 
 search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where Processes.process
-    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","sudo*","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest
+    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`| `suspcious_linux_discovery_commands_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/)
-  Please install this add-on to parse fields correctly and execute detection search.
+| `security_content_ctime(lastTime)`| where dc>40| `suspcious_linux_discovery_commands_filter`'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
+  Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
   or audit a system, the execution of these commands should be monitored.
 references:
 - https://attack.mitre.org/matrices/enterprise/linux/
 - https://github.com/IvanGlinkin/AutoSUID
+- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
+- https://github.com/rebootuser/LinEnum
 tags:
   analytic_story:
   - Linux Post-Exploitation
@@ -30,7 +31,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
   impact: 90
   kill_chain_phases:
   - Exploitation
@@ -48,14 +49,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.user 
+  - Processes.process_name
   risk_score: 81
   security_domain: endpoint
diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
new file mode 100644
index 0000000000..e69de29bb2

From 11ab86fdf4d5cde5f581722fec7945381c8fa78c Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 14 Feb 2022 15:03:24 -0800
Subject: [PATCH 10/52] remove detections aalready covered

---
 ...detect_autosuid_post_exploitation_tool.yml | 61 ----------------
 .../endpoint/detect_linenum_execution.yml     | 70 -------------------
 .../endpoint/detect_linpeas_execution.yml     | 67 ------------------
 ...t_autosuid_post_exploitation_tool.test.yml | 12 ----
 .../detect_linenum_execution.test.yml         | 12 ----
 .../detect_linpeas_execution.test.yml         | 12 ----
 ...uspcious_linux_discovery_commands.test.yml | 12 ++++
 7 files changed, 12 insertions(+), 234 deletions(-)
 delete mode 100644 detections/endpoint/detect_autosuid_post_exploitation_tool.yml
 delete mode 100644 detections/endpoint/detect_linenum_execution.yml
 delete mode 100644 detections/endpoint/detect_linpeas_execution.yml
 delete mode 100644 tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
 delete mode 100644 tests/endpoint/detect_linenum_execution.test.yml
 delete mode 100644 tests/endpoint/detect_linpeas_execution.test.yml

diff --git a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml b/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
deleted file mode 100644
index 018d575224..0000000000
--- a/detections/endpoint/detect_autosuid_post_exploitation_tool.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-name: Detect AutoSUID post exploitation tool
-id: 0edd5862-56c9-11ec-b990-acde48001122
-version: 1
-date: '2021-12-06'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: This search, detects Linux post exploitation tool AutoSUID, which is
-  an a tool that searches for SUID executables files in order to escalate privileges.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = "find / -xdev -user root ( -perm -4000 -o -perm -2000 -o -perm -6000 )"
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_autosuid_post_exploitation_tool_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Unless an administrator is using these commands to troubleshoot
-  or audit a system, the execution of these commands should be monitored.
-references:
-- https://attack.mitre.org/matrices/enterprise/linux/
-- https://github.com/IvanGlinkin/AutoSUID
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 90
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  message: AutoSUID post exploitation tool detected on $dest$
-  mitre_attack_id:
-  - T1069
-  - T1222
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 81
-  security_domain: endpoint
diff --git a/detections/endpoint/detect_linenum_execution.yml b/detections/endpoint/detect_linenum_execution.yml
deleted file mode 100644
index 2e86488d62..0000000000
--- a/detections/endpoint/detect_linenum_execution.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Detect LinEnum execution
-id: 570e5278-5479-11ec-89c8-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: LinEnum is a bash script that performs discovery commands for accounts,
-  processes, kernel version, applications, services, and uses the information from
-  these commands to present operator with ways of escalating privileges or further
-  exploitation of targeted host.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.process = "grep -w aria2c\\|arp\\|ash\\|awk\\|base64\\|bash\\|busybox\\|cat\\|chmod\\|chown\\|cp\\|csh\\|curl\\|cut\\|dash\\|date\\|dd\\|diff\\|dmsetup\\|docker\\|ed\\|emacs\\|env\\|expand\\|expect\\|file\\|find\\|flock\\|fmt\\|fold\\|ftp\\|gawk\\|gdb\\|gimp\\|git\\|grep\\|head\\|ht\\|iftop\\|ionice\\|ip$\\|irb\\|jjs\\|jq\\|jrunscript\\|ksh\\|ld.so\\|ldconfig\\|less\\|logsave\\|lua\\|make\\|man\\|mawk\\|more\\|mv\\|mysql\\|nano\\|nawk\\|nc\\|netcat\\|nice\\|nl\\|nmap\\|node\\|od\\|openssl\\|perl\\|pg\\|php\\|pic\\|pico\\|python\\|readelf\\|rlwrap\\|rpm\\|rpmquery\\|rsync\\|ruby\\|run-parts\\|rvim\\|scp\\|script\\|sed\\|setarch\\|sftp\\|sh\\|shuf\\|socat\\|sort\\|sqlite3\\|ssh$\\|start-stop-daemon\\|stdbuf\\|strace\\|systemctl\\|tail\\|tar\\|taskset\\|tclsh\\|tee\\|telnet\\|tftp\\|time\\|timeout\\|ul\\|unexpand\\|uniq\\|unshare\\|vi\\|vim\\|watch\\|wget\\|wish\\|xargs\\|xxd\\|zip\\|zsh"
-    by Processes.dest Processes.user Processes.parent_process_name Processes.process_current_directory
-    Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `detect_linenum_execution_filter` '
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Very rare to perform such an extensive grep on a system, however
-  certain monitoring tools can produce similar results. It is important if monitoring
-  tools are in place to verify what is the actual process directory of execution.
-references:
-- https://github.com/rebootuser/LinEnum
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 90
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
-  impact: 50
-  kill_chain_phases:
-  - Privilege Escalation
-  message: LinEnum post exploitation tool detectedonn $dest$
-  mitre_attack_id:
-  - T1087
-  - T1069
-  - T1083
-  - T1057
-  - T1518
-  - T1082
-  - T1016
-  - T1033
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 45
-  security_domain: endpoint
diff --git a/detections/endpoint/detect_linpeas_execution.yml b/detections/endpoint/detect_linpeas_execution.yml
deleted file mode 100644
index 1a7ee0715c..0000000000
--- a/detections/endpoint/detect_linpeas_execution.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Detect LinPeas Execution
-id: 4ea6fa10-547c-11ec-a4f9-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto, Eric McGinnis
-type: TTP
-datamodel:
-- Endpoint
-description: Linux local Privilege Escalation Awesome Script (linPEAS) is a script
-  that searches for possible paths to escalate privileges.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process= "grep -Ev ._history.|.bashrc|.bluemix|.cer|.cloudflared|.crt|.csr|.db|.der|.env|.erlang.cookie|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd|.irssi|.jks|.k5login|.kdbx|.key|.keyring|.keystore|.ldaprc|.lesshst|.mozilla|.msmtprc|.ovpn|.p12|.pem|.pfx|.pgp|.plan|.profile|.pypirc|.rdg|.recently-used.xbel|.rhosts|.secrets.mkey|.service|.socket|.sqlite|.sqlite3|.sudo_as_admin_successful|.svn|.swp|.timer|.vault-token|.viminfo|.vnc|.wgetrc" OR Processes.process="find /var/log/ /private/var/log -type f -exec grep -R -a -E -o (25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) {} ;" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `detect_linpeas_execution_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: This search may produce false positives as it will display
-  many sudo executed processess however, the cve-list within the command line it is
-  a clear indicator, operator is searching for local vulnerabilites.
-references:
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
-- https://attack.mitre.org/matrices/enterprise/linux/
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  confidence: 100
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  - Privilege Escalation
-  message: LinPEAS post exploitation tool detected on $dest$
-  mitre_attack_id:
-  - T1082
-  - T1083
-  - T1033
-  - T1087
-  - T1046
-  - T1057
-  - T1518
-  - T1033
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - dest
-  - user
-  - process
-  - parent_process_name
-  - user 
-  - process_name
-  - process_id 
-  - parent_process_id 
-  - process_guid
-  risk_score: 90
-  security_domain: endpoint
diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
deleted file mode 100644
index 29c16b458d..0000000000
--- a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect AutoSUID post exploitation tool Unit Test
-tests:
-- name: Detect AutoSUID post exploitation tool
-  file: endpoint/detect_autosuid_post_exploitation_tool.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: autoSUID.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml
deleted file mode 100644
index 85d7de99da..0000000000
--- a/tests/endpoint/detect_linenum_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect LinEnum execution unit Test
-tests:
-- name: Detect LinEnum execution
-  file: endpoint/detect_linenum_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: LinuxEnumd.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml
deleted file mode 100644
index 1e7397a056..0000000000
--- a/tests/endpoint/detect_linpeas_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect LinPeas Execution Unit Test
-tests:
-- name: Detect LinPeas Execution
-  file: endpoint/detect_linpeas_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: linpeasdataset.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
index e69de29bb2..c9de874729 100644
--- a/tests/endpoint/suspcious_linux_discovery_commands.test.yml
+++ b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
@@ -0,0 +1,12 @@
+name: Suspcious Linux Discovery Commands
+tests:
+- name: Linux Possible Access To Sudoers File
+  file: endpoint/suspcious_linux_discovery_commands.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon_linux.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
+    source: Syslog:Linux-Sysmon/Operational
+    sourcetype: sysmon_linux
\ No newline at end of file

From e2b0e4c32bfcc62c91f0491c3ca1b9fa244cc25c Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Feb 2022 10:21:43 -0800
Subject: [PATCH 11/52] mionr

---
 detections/endpoint/suspcious_linux_discovery_commands.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index e05e41eee2..ac97bf33cc 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -19,6 +19,7 @@ known_false_positives: Unless an administrator is using these commands to troubl
   or audit a system, the execution of these commands should be monitored.
 references:
 - https://attack.mitre.org/matrices/enterprise/linux/
+- https://attack.mitre.org/techniques/T1059/004/
 - https://github.com/IvanGlinkin/AutoSUID
 - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
 - https://github.com/rebootuser/LinEnum

From c51621060c0824a6a0a7044aa8321e4ed9d7dfb1 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 16 Feb 2022 14:16:15 -0500
Subject: [PATCH 12/52] update detection and adding a new one

---
 ...asting_spn_request_with_rc4_encryption.yml | 25 ++++---
 ...ticket_exports_through_winlogon_access.yml |  5 +-
 ..._of_kerberos_service_tickets_requested.yml | 69 +++++++++++++++++++
 ...erberos_service_tickets_requested.test.yml | 12 ++++
 4 files changed, 98 insertions(+), 13 deletions(-)
 create mode 100644 detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
 create mode 100644 tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml

diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
index 7ea40e6c1f..0c9a953140 100644
--- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
+++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
@@ -1,20 +1,23 @@
 name: Kerberoasting spn request with RC4 encryption
 id: 5cc67381-44fa-4111-8a37-7a230943f027
-version: 3
-date: '2020-10-16'
-author: Jose Hernandez, Patrick Bareiss, Splunk
+version: 4
+date: '2022-02-09'
+author: Jose Hernandez, Patrick Bareiss, Mauricio Velazcu, Splunk
 type: TTP
 datamodel: []
-description: This search detects a potential kerberoasting attack via service principal
-  name requests
-search: '`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17
+description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
+ against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
+ attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field
+ based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options.
+search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000) Ticket_Encryption_Type=0x17
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id,
   Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `kerberoasting_spn_request_with_rc4_encryption_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  and include the windows security event logs that contain kerberos
-known_false_positives: Older systems that support kerberos RC4 by default NetApp may
-  generate false positives
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: Older systems that support kerberos RC4 by default like NetApp may
+  generate false positives. Filter as needed
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md
 - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity
@@ -39,8 +42,8 @@ tags:
   message: Potential kerberoasting attack via service principal name requests detected
     on $dest$
   mitre_attack_id:
-  - T1558.003
   - T1558
+  - T1558.003
   nist:
   - DE.CM
   observable:
diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
index 33fea11916..e2bc4817d8 100644
--- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
@@ -6,7 +6,8 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior
-  when using the Rubeus tool to monitor for and export kerberos tickets from memory. Exporting tickets from memory is typically the first step for pass the ticket attacks.
+  when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by
+  obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks.
   Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.
   Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic.
 search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
@@ -18,7 +19,7 @@ search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe
   Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
 how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
-  includes EventCode 10.exe. This search uses an input macro named `sysmon`.
+  includes EventCode 10. This search uses an input macro named `sysmon`.
   We strongly recommend that you specify your environment-specific configurations
   (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
   with configurations for your Splunk environment.
diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
new file mode 100644
index 0000000000..8e7b49bf95
--- /dev/null
+++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
@@ -0,0 +1,69 @@
+name: Unusual Number of Kerberos Service Tickets Requested
+id: eb3e6702-8936-11ec-98fe-acde48001122
+version: 1
+date: '2022-02-08'
+author: Mauricio Velazco, Splunk
+type: Anomaly
+datamodel: []
+description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
+ against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
+ attempt to crack them offline allowing them to obtain privileged access to the domain. 
+
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this
+ analytic, users can try different combinations of the `bucket` span time and the
+ calculation of the `upperBound` field. 
+
+search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17
+| bucket span=2m _time
+| stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address
+| eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std by Client_Address
+| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
+| search isOutlier=1
+| `unusual_number_of_kerberos_service_tickets_requested_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: An single endpoint requesting a large number of kerberos service
+  tickets is not common behavior. Possible false positive scenarios include but are
+  not limited to vulnerability scanners, administration systems and missconfigured
+  systems.
+references:
+- https://attack.mitre.org/techniques/T1558/003/
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting 
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - Service_Name
+  - service_id
+  - Client_Address
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: 
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml b/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml
new file mode 100644
index 0000000000..b942d279d0
--- /dev/null
+++ b/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml
@@ -0,0 +1,12 @@
+name: Unusual Number of Kerberos Service Tickets Requested Unit Test
+tests:
+- name: Unusual Number of Kerberos Service Tickets Requested
+  file: endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
\ No newline at end of file

From 0be99ab0d6b0edf87a732740a41ae6184ce11ccd Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 16 Feb 2022 12:23:54 -0800
Subject: [PATCH 13/52] Removed extra newlines

Extra newlines in 'description' was
were causing issues with the generation
of saved_searches.conf
---
 .../unusual_number_of_kerberos_service_tickets_requested.yml  | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
index 8e7b49bf95..6f52ce6dee 100644
--- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
@@ -8,12 +8,10 @@ datamodel: []
 description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
  against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
  attempt to crack them offline allowing them to obtain privileged access to the domain. 
-
  The detection calculates the standard deviation for each host and leverages the
  3-sigma statistical rule to identify an unusual number service ticket requests. To customize this
  analytic, users can try different combinations of the `bucket` span time and the
  calculation of the `upperBound` field. 
-
 search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17
 | bucket span=2m _time
 | stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address
@@ -66,4 +64,4 @@ tags:
   - name: Client_Address
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim

From 550a592f78d64992c35dd9ce7b64d7a332e6ff0e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 16 Feb 2022 13:42:16 -0800
Subject: [PATCH 14/52] Re-adding newline

Adding newline back with proper format. Requires a backslash in front.
---
 .../unusual_number_of_kerberos_service_tickets_requested.yml   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
index 6f52ce6dee..dbafa42be0 100644
--- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
@@ -7,7 +7,8 @@ type: Anomaly
 datamodel: []
 description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
  against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
- attempt to crack them offline allowing them to obtain privileged access to the domain. 
+ attempt to crack them offline allowing them to obtain privileged access to the domain.\
+ 
  The detection calculates the standard deviation for each host and leverages the
  3-sigma statistical rule to identify an unusual number service ticket requests. To customize this
  analytic, users can try different combinations of the `bucket` span time and the

From 9d780700de404bc0b469e4816f4041e98d7494bc Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 16 Feb 2022 16:23:19 -0800
Subject: [PATCH 15/52] lookupss

---
 lookups/linux_tool_discovery_process.csv | 56 ++++++++++++++++++++++++
 lookups/linux_tool_discovery_process.yml |  7 +++
 2 files changed, 63 insertions(+)
 create mode 100644 lookups/linux_tool_discovery_process.csv
 create mode 100644 lookups/linux_tool_discovery_process.yml

diff --git a/lookups/linux_tool_discovery_process.csv b/lookups/linux_tool_discovery_process.csv
new file mode 100644
index 0000000000..4075875c08
--- /dev/null
+++ b/lookups/linux_tool_discovery_process.csv
@@ -0,0 +1,56 @@
+process
+cat /proc/version
+cat /etc/*-release
+/etc/passwd 
+cat /etc/*
+lastlog 
+id
+PermitRootLogin
+sestatus *
+ps
+mysql*
+netstat*
+find *
+head /var/mail/root
+docker
+cat /etc/issue
+cat /etc/*-release
+cat /proc/version
+uname -a
+uname -mrs
+rpm -q kernel
+dmesg | grep Linux
+ls /boot | grep vmlinuz-
+cat /etc/profile
+cat /etc/bashrc
+cat ~/.bash_profile
+cat ~/.bashrc
+cat ~/.bash_logout
+ps -aux | grep root
+ps -ef | grep root
+crontab -l
+cat /etc/cron*
+cat /etc/cron.allow
+cat /etc/cron.deny
+cat /etc/crontab
+grep -i user *
+grep -i pass *
+ifconfig
+cat /etc/network/interfaces
+cat /etc/sysconfig/network
+cat /etc/resolv.conf
+cat /etc/networks
+iptables -L
+lsof -i
+netstat -antup
+netstat -antpx
+netstat -tulpn
+arp -e
+route
+cat /etc/passwd
+cat /etc/group
+cat /etc/shadow
+find / -perm -u=s
+find / -perm -g=s
+find / -perm -4000
+find / -perm -2000
\ No newline at end of file
diff --git a/lookups/linux_tool_discovery_process.yml b/lookups/linux_tool_discovery_process.yml
new file mode 100644
index 0000000000..51eee3b99a
--- /dev/null
+++ b/lookups/linux_tool_discovery_process.yml
@@ -0,0 +1,7 @@
+description: A list of suspcious bash commonly used by attackers via scripts
+filename: linux_tool_discovery_process.csv
+name: linux_tool_discovery_process
+default_match: 'false'
+match_type: WILDCARD(process)
+min_matches: 1
+case_sensitive_match: 'false'
\ No newline at end of file

From c80a1fdb8343d8465265c49728857907eba12200 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 16 Feb 2022 16:26:43 -0800
Subject: [PATCH 16/52] spl update

---
 detections/endpoint/suspcious_linux_discovery_commands.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index ac97bf33cc..0e44085aa0 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -8,8 +8,7 @@ datamodel:
 - Endpoint
 description: This search, detects execution of high number of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of vulnerable directories, executables and file permissions on a Linux host. The search logic specifically looks for high number of distinct commands run in a short period of time. 
 search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.process
-    IN ("uname -a","cat /proc/version", "cat /etc/*-release","/etc/passwd" ,"cat /etc/*", "lastlog", "id","PermitRootLogin","sestatus *","ps","mysql*","netstat*","find *","mysql*","head /var/mail/root","docker","cat /etc/issue","cat /etc/*-release","cat /proc/version","uname -a","uname -mrs","rpm -q kernel","dmesg | grep Linux","ls /boot | grep vmlinuz-","cat /etc/profile","cat /etc/bashrc","cat ~/.bash_profile","cat ~/.bashrc","cat ~/.bash_logout", "ps -aux | grep root","ps -ef | grep root","crontab -l","cat /etc/cron*","cat /etc/cron.allow","cat /etc/cron.deny","cat /etc/crontab","grep -i user *","grep -i pass *","ifconfig","cat /etc/network/interfaces","cat /etc/sysconfig/network","cat /etc/resolv.conf","cat /etc/networks","iptables -L","lsof -i","netstat -antup","netstat -antpx","netstat -tulpn","arp -e","route","cat /etc/passwd","cat /etc/group","cat /etc/shadow","find / -perm -u=s","find / -perm -g=s","find / -perm -4000","find / -perm -2000") by _time span=5m Processes.user Processes.dest 
+    as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)`| where dc>40| `suspcious_linux_discovery_commands_filter`'

From b472113e648640b47091c98d31bdfb828c7c0571 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 17 Feb 2022 10:52:51 -0500
Subject: [PATCH 17/52] updating detection with proper dataset

---
 ...kerberoasting_spn_request_with_rc4_encryption.yml |  4 ++--
 stories/active_directory_kerberos_attacks.yml        | 12 +++++++++---
 ...roasting_spn_request_with_rc4_encryption.test.yml |  2 +-
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
index 0c9a953140..cb6069ae6d 100644
--- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
+++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
@@ -2,7 +2,7 @@ name: Kerberoasting spn request with RC4 encryption
 id: 5cc67381-44fa-4111-8a37-7a230943f027
 version: 4
 date: '2022-02-09'
-author: Jose Hernandez, Patrick Bareiss, Mauricio Velazcu, Splunk
+author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
@@ -35,7 +35,7 @@ tags:
   - Source:Endpoint
   - Stage:Credential Access
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
   impact: 90
   kill_chain_phases:
   - Privilege Escalation
diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml
index d261a896d8..e59016ba52 100644
--- a/stories/active_directory_kerberos_attacks.yml
+++ b/stories/active_directory_kerberos_attacks.yml
@@ -3,10 +3,16 @@ id: 38b8cf16-8461-11ec-ade1-acde48001122
 version: 1
 date: '2022-02-02'
 author: Mauricio Velazco, Splunk
-description: UPDATE_DESCRIPTION
-narrative: UPDATE_NARRATIVE
+description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
+narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and
+ users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access
+ to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks.
 references:
-- https://www.destroyallsoftware.com/talks/wat
+- https://en.wikipedia.org/wiki/Kerberos_(protocol)
+- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://attack.mitre.org/techniques/T1558/003/
+- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
diff --git a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml
index 5ae101f436..0e95642c09 100644
--- a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml
+++ b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log
     source: WinEventLog:Security
     sourcetype: WinEventLog
     update_timestamp: True

From 52d0996b0af19d19d1a8fa27aa699a9053b3bcd4 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 17 Feb 2022 16:28:19 -0800
Subject: [PATCH 18/52] combined the rest 2

---
 ...tect_linux_exploit_suggester_execution.yml | 57 -------------------
 detections/endpoint/detect_mimipenguin.yml    | 55 ------------------
 lookups/linux_tool_discovery_process.csv      |  5 ++
 ...linux_exploit_suggester_execution.test.yml | 12 ----
 tests/endpoint/detect_mimipenguin.test.yml    | 12 ----
 5 files changed, 5 insertions(+), 136 deletions(-)
 delete mode 100644 detections/endpoint/detect_linux_exploit_suggester_execution.yml
 delete mode 100644 detections/endpoint/detect_mimipenguin.yml
 delete mode 100644 tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
 delete mode 100644 tests/endpoint/detect_mimipenguin.test.yml

diff --git a/detections/endpoint/detect_linux_exploit_suggester_execution.yml b/detections/endpoint/detect_linux_exploit_suggester_execution.yml
deleted file mode 100644
index 3194022906..0000000000
--- a/detections/endpoint/detect_linux_exploit_suggester_execution.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Detect Linux Exploit Suggester Execution
-id: a4f34d5c-547b-11ec-ba88-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: This search detects Linux Exploit Suggester tool execution. This is a
-  tool that searches for vulnerabilities based on Kernel and Distribution versions
-  then queries public exploit databases.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process="uname -a" OR Processes.process="cvelist-file:*" OR Processes.process="*exploit*" OR Processes.process="*exploit-db*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_linux_exploit_suggester_execution_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Monitoring tools may produce similar commands although the
-  presence of "exploit-db" is very unusual.
-references:
-- https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
-- https://attack.mitre.org/matrices/enterprise/linux/
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 100
-  context:
-  - Source:Endpoint
-  - Stage:Discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
-  impact: 90
-  kill_chain_phases:
-  - Exploitation
-  - Privilege Escalation
-  message: Linux Exploit Suggester post exploitation tool detected.
-  mitre_attack_id:
-  - T1087
-  - T1083
-  - T1069
-  - T1057
-  - T1518
-  - T1082
-  observable:
-  - name: Computer
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - CommandLine
-  risk_score: 90
-  security_domain: endpoint
diff --git a/detections/endpoint/detect_mimipenguin.yml b/detections/endpoint/detect_mimipenguin.yml
deleted file mode 100644
index fc82708395..0000000000
--- a/detections/endpoint/detect_mimipenguin.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Detect MimiPenguin
-id: 1ad20afa-547b-11ec-b4e7-acde48001122
-version: 1
-date: '2021-12-03'
-author: Rod Soto
-type: TTP
-datamodel:
-- Endpoint
-description: MimiPenguin is a tool that dumps login passwords from current linux destop
-  users. This search detects execution of this tool.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process="strings -e /etc/apache2/apache2.conf" OR Processes.process="strings -e /etc/ssh/sshd_config" OR Processes.process="strings -e /etc/shadow" by Processes.dest 
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimipenguin_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.
-  Need to install this add-on to parse fields correctly and execute detection search.
-known_false_positives: Some of these commands may be executed by sysadmin however
-  not in the proximity and frequency, specially if querying for tools are that knonwn
-  not to be installed at target system.
-references:
-- https://github.com/huntergregal/mimipenguin
-- https://attack.mitre.org/matrices/enterprise/linux/
-tags:
-  analytic_story:
-  - Linux Post-Exploitation
-  automated_detection_testing: passed
-  confidence: 70
-  context:
-  - Source: endpoint
-  - Stage: discovery
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
-  impact: 50
-  kill_chain_phases:
-  - Privilege Escalation
-  message: MimiPenguin post exploitation tool detected
-  mitre_attack_id:
-  - T1552
-  observable:
-  - name: Computer
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - user
-  - Computer
-  - parent_process
-  - process_current_directory
-  risk_score: 35
-  security_domain: endpoint
diff --git a/lookups/linux_tool_discovery_process.csv b/lookups/linux_tool_discovery_process.csv
index 4075875c08..98b55d4efc 100644
--- a/lookups/linux_tool_discovery_process.csv
+++ b/lookups/linux_tool_discovery_process.csv
@@ -40,6 +40,11 @@ cat /etc/network/interfaces
 cat /etc/sysconfig/network
 cat /etc/resolv.conf
 cat /etc/networks
+cvelist-file:*
+exploit-db*
+strings -e /etc/apache2/apache2.conf
+strings -e /etc/ssh/sshd_config
+strings -e /etc/shadow
 iptables -L
 lsof -i
 netstat -antup
diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
deleted file mode 100644
index 1efcd32d23..0000000000
--- a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect Linux Exploit Suggester Execution Unit Test
-tests:
-- name: Detect Linux Exploit Suggester Execution
-  file: endpoint/detect_linux_exploit_suggester_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: linuxexploitsuggesterdatasets.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml
deleted file mode 100644
index a2fff212b5..0000000000
--- a/tests/endpoint/detect_mimipenguin.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect MimiPenguin Unit Test
-tests:
-- name: Detect MimiPenguin
-  file: endpoint/detect_mimipenguin.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: mimipenguin.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"

From ac9c46cffa1c31335d43e3aec98f770af8b685fa Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 17 Feb 2022 16:44:09 -0800
Subject: [PATCH 19/52] updating search conditions

---
 .../endpoint/suspcious_linux_discovery_commands.yml       | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspcious_linux_discovery_commands.yml
index 0e44085aa0..35e130287f 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspcious_linux_discovery_commands.yml
@@ -6,12 +6,14 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search, detects execution of high number of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of vulnerable directories, executables and file permissions on a Linux host. The search logic specifically looks for high number of distinct commands run in a short period of time. 
-search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as dc min(_time) as firstTime max(_time)
+description: This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\
+  
+  The search logic specifically looks for high number of distinct commands run in a short period of time. 
+search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`| where dc>40| `suspcious_linux_discovery_commands_filter`'
+| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspcious_linux_discovery_commands_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
   Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
 known_false_positives: Unless an administrator is using these commands to troubleshoot

From 98f6bc09c6434eb469b6a07f26ed346924ded025 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Fri, 18 Feb 2022 10:30:54 -0500
Subject: [PATCH 20/52] updating analytic story description

---
 .../kerberoasting_spn_request_with_rc4_encryption.yml       | 2 +-
 stories/active_directory_kerberos_attacks.yml               | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
index cb6069ae6d..d1379ef8d1 100644
--- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
+++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
@@ -9,7 +9,7 @@ description: The following analytic leverages Kerberos Event 4769, A Kerberos se
  against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and 
  attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field
  based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options.
-search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000) Ticket_Encryption_Type=0x17
+search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id,
   Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `kerberoasting_spn_request_with_rc4_encryption_filter`'
diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml
index e59016ba52..4e145a4e4c 100644
--- a/stories/active_directory_kerberos_attacks.yml
+++ b/stories/active_directory_kerberos_attacks.yml
@@ -6,7 +6,11 @@ author: Mauricio Velazco, Splunk
 description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
 narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and
  users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access
- to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks.
+ to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since
+ the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases 
+ of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\
+ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in 
+ Kerberos based attacks.
 references:
 - https://en.wikipedia.org/wiki/Kerberos_(protocol)
 - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9

From c544488575d7b6c891c291484f8ea3839d3c7088 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Fri, 18 Feb 2022 17:42:58 -0500
Subject: [PATCH 21/52] adding asp roasting detection T1558.004

---
 ...uthentication_discovery_with_powerview.yml | 58 +++++++++++++++++++
 .../rubeus_command_line_parameters.yml        |  3 +
 ...tication_discovery_with_powerview.test.yml | 12 ++++
 3 files changed, 73 insertions(+)
 create mode 100644 detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
 create mode 100644 tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml

diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
new file mode 100644
index 0000000000..7c474cfba5
--- /dev/null
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -0,0 +1,58 @@
+name: Disabled Kerberos Pre-Authentication Discovery With PowerView
+id: b0b34e2c-90de-11ec-baeb-acde48001122
+version: 1
+date: '2022-02-18'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser`
+  is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks.
+  As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired`
+  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
+  Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
+search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerView for troubleshooting
+references:
+- https://attack.mitre.org/techniques/T1558/004/
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 60
+  confidence: 90 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$
\ No newline at end of file
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index befe3f64e0..b3117686de 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -38,6 +38,9 @@ tags:
   mitre_attack_id:
   - T1550
   - T1550.003
+  - T1558
+  - T1558.003
+  - T1558.004
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
new file mode 100644
index 0000000000..95445f94db
--- /dev/null
+++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
@@ -0,0 +1,12 @@
+name: Disabled Kerberos Pre-Authentication Discovery With PowerView Unit Test
+tests:
+- name: Disabled Kerberos Pre-Authentication Discovery With PowerView
+  file: endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file

From 78b79d31e77446d7cc6ec35816c3b2643a5da925 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 22 Feb 2022 13:19:13 -0500
Subject: [PATCH 22/52] adding new detection for T1558.004

---
 ...thentication_discovery_with_get_aduser.yml | 62 +++++++++++++++++++
 ...uthentication_discovery_with_powerview.yml |  2 +-
 stories/active_directory_kerberos_attacks.yml |  1 +
 ...ication_discovery_with_get_aduser.test.yml | 15 +++++
 4 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
 create mode 100644 tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml

diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
new file mode 100644
index 0000000000..27ee132288
--- /dev/null
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
@@ -0,0 +1,62 @@
+name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
+id: 114c6bfe-9406-11ec-bcce-acde48001122
+version: 1
+date: '2022-02-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser`
+  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
+  As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser 
+  allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
+  Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
+references:
+- https://attack.mitre.org/techniques/T1558/004/
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 60
+  confidence: 90 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$
\ No newline at end of file
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index 7c474cfba5..37adc01659 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -17,7 +17,7 @@ search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message=
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators or power users may use this PowerView for troubleshooting
+known_false_positives: Administrators or power users may use PowerView for troubleshooting
 references:
 - https://attack.mitre.org/techniques/T1558/004/
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml
index 4e145a4e4c..44adeb59ac 100644
--- a/stories/active_directory_kerberos_attacks.yml
+++ b/stories/active_directory_kerberos_attacks.yml
@@ -15,6 +15,7 @@ references:
 - https://en.wikipedia.org/wiki/Kerberos_(protocol)
 - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
 - https://attack.mitre.org/techniques/T1558/003/
 - https://attack.mitre.org/techniques/T1550/003/
 tags:
diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
new file mode 100644
index 0000000000..034af504ea
--- /dev/null
+++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
@@ -0,0 +1,15 @@
+name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser Unit Test
+tests:
+- name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
+  file: endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
+
+
+

From 18fe0a505065d22586626ecf0382fbee19919879 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 23 Feb 2022 11:24:04 -0500
Subject: [PATCH 23/52] adding new detection for T1558.004

---
 ...on_flag_disabled_in_useraccountcontrol.yml | 59 +++++++++++++++++++
 ...ag_disabled_in_useraccountcontrol.test.yml | 13 ++++
 2 files changed, 72 insertions(+)
 create mode 100644 detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
 create mode 100644 tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml

diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
new file mode 100644
index 0000000000..246ac64829
--- /dev/null
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
@@ -0,0 +1,59 @@
+name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
+id: 0cb847ee-9423-11ec-b2df-acde48001122
+version: 1
+date: '2022-02-22'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic leverages Windows Security Event 4738, `A user account was changed`,
+  to identify a change performed on a domain user object that disables Kerberos Pre-Authentication.
+  Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute
+  force attack against the user's password offline leveraging the ASP REP Roasting technique.
+  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
+  or a way to escalate privileges.
+search: ' EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*"
+| table EventCode, Account_Name, Security_ID, MSADChangedAttributes
+| `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events. The Advanced Security Audit policy setting
+  `User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: Unknown.
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+  kill_chain_phases:
+  - Intrusion
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Account_Name
+  - Security_ID
+  - MSADChangedAttributes
+  security_domain: endpoint
+  impact: 50
+  confidence: 90 
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
+  message: 
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml
new file mode 100644
index 0000000000..df1569133d
--- /dev/null
+++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml
@@ -0,0 +1,13 @@
+name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl Unit Test
+tests:
+- name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
+  file: endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
\ No newline at end of file

From 42e4f1784c2c7539e427d0a9d5a1e2090713eaae Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 23 Feb 2022 13:02:23 -0500
Subject: [PATCH 24/52] adding new detection for T1558.004

---
 ...on_flag_disabled_in_useraccountcontrol.yml |  4 +-
 ...tication_flag_disabled_with_powershell.yml | 57 +++++++++++++++++++
 stories/active_directory_kerberos_attacks.yml |  1 +
 ...ion_flag_disabled_with_powershell.test.yml | 13 +++++
 4 files changed, 73 insertions(+), 2 deletions(-)
 create mode 100644 detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
 create mode 100644 tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml

diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
index 246ac64829..3764b64382 100644
--- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
@@ -11,7 +11,7 @@ description: The following analytic leverages Windows Security Event 4738, `A us
   force attack against the user's password offline leveraging the ASP REP Roasting technique.
   Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
   or a way to escalate privileges.
-search: ' EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*"
+search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*"
 | table EventCode, Account_Name, Security_ID, MSADChangedAttributes
 | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -51,7 +51,7 @@ tags:
   - Source:Endpoint
   - Stage:PrivilegeEscalation
   - Stage:Persistence
-  message: 
+  message: Kerberos Pre Authentication was Disabled for $Account_Name$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
new file mode 100644
index 0000000000..accc8e3f26
--- /dev/null
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
@@ -0,0 +1,57 @@
+name: Kerberos Pre-Authentication Flag Disabled with PowerShell
+id: 59b51620-94c9-11ec-b3d5-acde48001122
+version: 1
+date: '2022-02-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl`
+  is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
+  As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account.
+  With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to
+  to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique.
+  Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
+  or a way to escalate privileges.
+search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes.
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
+- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+  kill_chain_phases:
+  - Intrusion
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1558
+  - T1558.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 90 
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:PrivilegeEscalation
+  - Stage:Persistence
+  message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml
index 44adeb59ac..fe3ad3cd62 100644
--- a/stories/active_directory_kerberos_attacks.yml
+++ b/stories/active_directory_kerberos_attacks.yml
@@ -18,6 +18,7 @@ references:
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
 - https://attack.mitre.org/techniques/T1558/003/
 - https://attack.mitre.org/techniques/T1550/003/
+- https://attack.mitre.org/techniques/T1558/004/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml
new file mode 100644
index 0000000000..3dec3df43a
--- /dev/null
+++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml
@@ -0,0 +1,13 @@
+name: Kerberos Pre-Authentication Flag Disabled with PowerShell Unit Test
+tests:
+- name: Kerberos Pre-Authentication Flag Disabled with PowerShell
+  file: endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
\ No newline at end of file

From fd78987f8c28db66c68458c6afc6130d391a7c92 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 23 Feb 2022 13:23:53 -0500
Subject: [PATCH 25/52] updating dataset url

---
 ...erberos_pre_authentication_flag_disabled_with_powershell.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
index accc8e3f26..18446fda3a 100644
--- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
@@ -28,7 +28,7 @@ tags:
   analytic_story:
   - Active Directory Kerberos Attacks
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
   kill_chain_phases:
   - Intrusion
   - Privilege Escalation

From 9a0770e78f1cd282622cd396aee27ed7bc645b7c Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 23 Feb 2022 13:40:43 -0500
Subject: [PATCH 26/52] fixing source in test file

---
 ..._pre_authentication_flag_disabled_with_powershell.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml
index 3dec3df43a..2abcf3d741 100644
--- a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml
+++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml
@@ -8,6 +8,6 @@ tests:
   attack_data:
   - file_name: windows-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
     update_timestamp: True
\ No newline at end of file

From 179d3e8eb57f6e3afa4d802a7a7accaa4cf8d211 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Wed, 23 Feb 2022 17:33:46 -0600
Subject: [PATCH 27/52] initial commit

---
 detections/endpoint/eventvwr_uac_bypass.yml   |  1 +
 .../ssa___windows_eventvwr_uac_bypass.yml     | 62 +++++++++++++++++++
 detections/endpoint/wsreset_uac_bypass.yml    |  1 +
 ...ssa___windows_eventvwr_uac_bypass.test.yml | 10 +++
 .../ssa___windows_wsreset_uac_bypass.test.yml | 11 ++++
 5 files changed, 85 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
 create mode 100644 tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml
 create mode 100644 tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml

diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
index d86049b7dc..9669c84655 100644
--- a/detections/endpoint/eventvwr_uac_bypass.yml
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - IcedID
+  - Living Off The Land
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
new file mode 100644
index 0000000000..c102612000
--- /dev/null
+++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
@@ -0,0 +1,62 @@
+name: Windows Eventvwr UAC Bypass
+id: 66adff66-90d9-11ec-aba7-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "int", null) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\shell\\open\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+-  https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - IcedID
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - event_id
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
+  security_domain: endpoint
+  impact: 80
+  confidence: 100 
+  risk_score: 80
+  context: 
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 14
\ No newline at end of file
diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index b422b0def9..f58b522cbe 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Living Off The Land 
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml b/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml
new file mode 100644
index 0000000000..4ecb8affd8
--- /dev/null
+++ b/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml
@@ -0,0 +1,10 @@
+name: Windows Eventvwr UAC Bypass Unit Test
+tests:
+- name: Windows Eventvwr UAC Bypass
+  file: endpoint/ssa___windows_eventvwr_uac_bypass.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon-registry.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml b/tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml
new file mode 100644
index 0000000000..61f5eba349
--- /dev/null
+++ b/tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml
@@ -0,0 +1,11 @@
+name: Windows WSReset UAC Bypass Unit Test
+tests:
+- name: Windows WSReset UAC Bypass
+  file: endpoint/ssa___windows_wsreset_uac_bypass.yml
+  pass_condition: '@count_gt(0)'
+  description: Test Windows WSReset UAC Bypass detections
+  attack_data:
+    - file_name: hidden_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+      sourcetype: xmlwineventlog
\ No newline at end of file

From aa03cc011a5abc39f85f160c1ba00efe29c61195 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Wed, 23 Feb 2022 18:16:40 -0600
Subject: [PATCH 28/52] updates

---
 detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
index c102612000..612b865c32 100644
--- a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
+++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint_Registry
 description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "int", null) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\shell\\open\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\shell\\open\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references:

From 9cf8199444ff91c0c8cdad93f75025f0aebbd588 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Wed, 23 Feb 2022 18:18:40 -0600
Subject: [PATCH 29/52] update again

---
 detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
index 612b865c32..af4089645e 100644
--- a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
+++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint_Registry
 description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\shell\\open\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references:

From be19bf61b921b5faa2a33519feb1240750adeb40 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Wed, 23 Feb 2022 18:26:26 -0600
Subject: [PATCH 30/52] fixed like statement

---
 detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
index af4089645e..fa2ece5a8e 100644
--- a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
+++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint_Registry
 description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references:

From 97120e2aeb3eb01cdac2b6276a90b369e772569c Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Wed, 23 Feb 2022 19:30:57 -0600
Subject: [PATCH 31/52] Added back other WIP detection

---
 .../ssa___windows_wsreset_uac_bypass.yml      | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_wsreset_uac_bypass.yml

diff --git a/detections/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/endpoint/ssa___windows_wsreset_uac_bypass.yml
new file mode 100644
index 0000000000..a6f54f30a2
--- /dev/null
+++ b/detections/endpoint/ssa___windows_wsreset_uac_bypass.yml
@@ -0,0 +1,47 @@
+name: Windows WSReset UAC Bypass
+id: 3118f0c2-90d9-11ec-b833-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control.
+search: '|from read_ssa_enriched_events() | where "Endpoint_Registry IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events() '
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+- https://github.com/hfiref0x/UACME
+- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass 
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  message: 
+  observable:
+  nist:
+  -
+  cis20:
+  -
\ No newline at end of file

From a3fc0779ae842b7c2f72f7634508ddb78a8010ae Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 24 Feb 2022 12:40:36 -0500
Subject: [PATCH 32/52] tagging password spraying detections

---
 ...ed_users_failing_to_authenticate_from_host_using_kerberos.yml | 1 +
 ...id_users_failing_to_authenticate_from_host_using_kerberos.yml | 1 +
 ...le_users_failing_to_authenticate_from_host_using_kerberos.yml | 1 +
 3 files changed, 3 insertions(+)

diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
index 8e60ca1557..7448859a68 100644
--- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
+++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml
index 3612834bee..135b96420c 100644
--- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml
+++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml
@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
index 2cc0ffadc0..5ebf02b7cc 100644
--- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
+++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
@@ -44,6 +44,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Password Spraying
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 70
   context:

From 15a77c78cc860240625ef2e14b64aaaac9785b14 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 24 Feb 2022 14:46:20 -0500
Subject: [PATCH 33/52] adding analytic story tag

---
 .../endpoint/serviceprincipalnames_discovery_with_setspn.yml     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
index b6afcc0355..8e3be8fa03 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
@@ -56,6 +56,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Active Directory Kerberos Attacks
   automated_detection_testing: passed
   confidence: 100
   context:

From 2c3f316756f32bba1cec621d219a65ef052f5e97 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 12:10:55 -0800
Subject: [PATCH 34/52] Update suspcious_linux_discovery_commands.test.yml

---
 tests/endpoint/suspcious_linux_discovery_commands.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
index c9de874729..0031680c1a 100644
--- a/tests/endpoint/suspcious_linux_discovery_commands.test.yml
+++ b/tests/endpoint/suspcious_linux_discovery_commands.test.yml
@@ -3,10 +3,10 @@ tests:
 - name: Linux Possible Access To Sudoers File
   file: endpoint/suspcious_linux_discovery_commands.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-30d'
+  earliest_time: '-60d'
   latest_time: 'now'
   attack_data:
   - file_name: sysmon_linux.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
-    sourcetype: sysmon_linux
\ No newline at end of file
+    sourcetype: sysmon_linux

From d075ca883b3fa4a156f705883db265506b7d181c Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 12:31:07 -0800
Subject: [PATCH 35/52] Update rubeus_command_line_parameters.yml

minor  change to context
---
 detections/endpoint/rubeus_command_line_parameters.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index b3117686de..49b18089a9 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -61,7 +61,7 @@ tags:
   risk_score: 36
   context:
   - Source:Endpoint
-  - Stage:PrivilegeEscalation
+  - Stage:Privilege Escalation
   message: Rubeus command line parameters were used on $dest$ 
   observable:
   - name: user
@@ -75,4 +75,4 @@ tags:
   - name: parent_process_name
     type: Parent Process
     role:
-    - Parent Process
\ No newline at end of file
+    - Parent Process

From 73752624a8282ec65afed63719e23942b902f54c Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 24 Feb 2022 14:54:46 -0700
Subject: [PATCH 36/52] updated story words

---
 stories/linux_post_exploitation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml
index c6050f86f4..0561684590 100644
--- a/stories/linux_post_exploitation.yml
+++ b/stories/linux_post_exploitation.yml
@@ -3,7 +3,7 @@ id: d310ccfe-5477-11ec-ad05-acde48001122
 version: 1
 date: '2021-12-03'
 author: Rod Soto
-description: This analytic story detects popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin
+description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.
 narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.
 references:
 - https://attack.mitre.org/matrices/enterprise/linux/

From 68dde34dc8fa01ae5fac18199985c15688978d4a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 14:14:13 -0800
Subject: [PATCH 37/52] rename typo

---
 ...commands.yml => suspicious_linux_discovery_commands.yml} | 6 +++---
 lookups/linux_tool_discovery_process.yml                    | 2 +-
 ...est.yml => suspicious_linux_discovery_commands.test.yml} | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)
 rename detections/endpoint/{suspcious_linux_discovery_commands.yml => suspicious_linux_discovery_commands.yml} (93%)
 rename tests/endpoint/{suspcious_linux_discovery_commands.test.yml => suspicious_linux_discovery_commands.test.yml} (72%)

diff --git a/detections/endpoint/suspcious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml
similarity index 93%
rename from detections/endpoint/suspcious_linux_discovery_commands.yml
rename to detections/endpoint/suspicious_linux_discovery_commands.yml
index 35e130287f..1a03a880dc 100644
--- a/detections/endpoint/suspcious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspicious_linux_discovery_commands.yml
@@ -1,4 +1,4 @@
-name: Suspcious Linux Discovery Commands
+name: Suspicious Linux Discovery Commands
 id: 0edd5112-56c9-11ec-b990-acde48001122
 version: 1
 date: '2021-12-06'
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
     as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspcious_linux_discovery_commands_filter`'
+| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
 how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). 
   Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
@@ -37,7 +37,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: Suspcious Linux Discovery Commands detected on $dest$
+  message: Suspicious Linux Discovery Commands detected on $dest$
   mitre_attack_id:
   - T1059.004
   observable:
diff --git a/lookups/linux_tool_discovery_process.yml b/lookups/linux_tool_discovery_process.yml
index 51eee3b99a..645544a521 100644
--- a/lookups/linux_tool_discovery_process.yml
+++ b/lookups/linux_tool_discovery_process.yml
@@ -1,4 +1,4 @@
-description: A list of suspcious bash commonly used by attackers via scripts
+description: A list of suspicious bash commonly used by attackers via scripts
 filename: linux_tool_discovery_process.csv
 name: linux_tool_discovery_process
 default_match: 'false'
diff --git a/tests/endpoint/suspcious_linux_discovery_commands.test.yml b/tests/endpoint/suspicious_linux_discovery_commands.test.yml
similarity index 72%
rename from tests/endpoint/suspcious_linux_discovery_commands.test.yml
rename to tests/endpoint/suspicious_linux_discovery_commands.test.yml
index c9de874729..0dcb7dac11 100644
--- a/tests/endpoint/suspcious_linux_discovery_commands.test.yml
+++ b/tests/endpoint/suspicious_linux_discovery_commands.test.yml
@@ -1,7 +1,7 @@
-name: Suspcious Linux Discovery Commands
+name: Suspicious Linux Discovery Commands
 tests:
-- name: Linux Possible Access To Sudoers File
-  file: endpoint/suspcious_linux_discovery_commands.yml
+- name: Suspicious Linux Discovery Commands
+  file: endpoint/suspicious_linux_discovery_commands.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-30d'
   latest_time: 'now'

From 55ffc28ae70a66967176996581e7b2db9900ff11 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 14:37:20 -0800
Subject: [PATCH 38/52] Update linux_post_exploitation.yml

---
 stories/linux_post_exploitation.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml
index 0561684590..f6214e87de 100644
--- a/stories/linux_post_exploitation.yml
+++ b/stories/linux_post_exploitation.yml
@@ -12,9 +12,8 @@ tags:
   - Linux Post-Exploitation
   category:
   - Adversary Tactics
-  - Privilege Escalation
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  usecase: Security Monitoring
\ No newline at end of file
+  usecase: Security Monitoring

From ca2163ae8c6767f0364c9a13242720c7b2bd683b Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Feb 2022 10:40:46 -0600
Subject: [PATCH 39/52] Moved to Experimental

---
 .../ssa___windows_wsreset_uac_bypass.yml      | 47 ------------------
 .../ssa___windows_wsreset_uac_bypass.yml      | 48 +++++++++++++++++++
 2 files changed, 48 insertions(+), 47 deletions(-)
 delete mode 100644 detections/endpoint/ssa___windows_wsreset_uac_bypass.yml
 create mode 100644 detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml

diff --git a/detections/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/endpoint/ssa___windows_wsreset_uac_bypass.yml
deleted file mode 100644
index a6f54f30a2..0000000000
--- a/detections/endpoint/ssa___windows_wsreset_uac_bypass.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Windows WSReset UAC Bypass
-id: 3118f0c2-90d9-11ec-b833-acde48001122
-version: 1
-date: '2022-02-18'
-author: Lou Stella, Splunk
-type: Anomaly
-datamodel:
-- Endpoint_Registry
-description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control.
-search: '|from read_ssa_enriched_events() | where "Endpoint_Registry IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events() '
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
-references:
-- https://github.com/hfiref0x/UACME
-- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass 
-tags:
-  analytic_story:
-  - Living Off The Land
-  - Windows Defense Evasion Tactics
-  dataset:
-  - UPDATE_DATASET_URL
-  kill_chain_phases:
-  - Privilege Escalation
-  mitre_attack_id:
-  - T1548.002
-  - T1548
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 
-  confidence: 
-  # (impact * confidence)/100
-  risk_score: 
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: 
-  observable:
-  nist:
-  -
-  cis20:
-  -
\ No newline at end of file
diff --git a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
new file mode 100644
index 0000000000..97b08bc1e3
--- /dev/null
+++ b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
@@ -0,0 +1,48 @@
+name: Windows WSReset UAC Bypass
+id: 3118f0c2-90d9-11ec-b833-acde48001122
+version: 1
+date: '2022-02-18'
+author: Lou Stella, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Registry
+description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events() '
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+- https://github.com/hfiref0x/UACME
+- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass 
+tags:
+  analytic_story:
+  - Living Off The Land
+  - Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  - T1548
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63 
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  message: 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 14
\ No newline at end of file

From 760747cea2940438edfd1c5dc0697b5477b93e38 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Feb 2022 10:46:46 -0600
Subject: [PATCH 40/52] Small update to body

---
 .../experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
index 97b08bc1e3..23366f9fd7 100644
--- a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
+++ b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint_Registry
 description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id, "registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events() '
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references:

From 4d05f75a0f0740d6ddabb7c0e57e4c107bacc4c1 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Feb 2022 10:48:30 -0600
Subject: [PATCH 41/52] Removed broken test

---
 .../ssa___windows_wsreset_uac_bypass.test.yml         | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml

diff --git a/tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml b/tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml
deleted file mode 100644
index 61f5eba349..0000000000
--- a/tests/endpoint/ssa___windows_wsreset_uac_bypass.test.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-name: Windows WSReset UAC Bypass Unit Test
-tests:
-- name: Windows WSReset UAC Bypass
-  file: endpoint/ssa___windows_wsreset_uac_bypass.yml
-  pass_condition: '@count_gt(0)'
-  description: Test Windows WSReset UAC Bypass detections
-  attack_data:
-    - file_name: hidden_windows-security.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
-      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-      sourcetype: xmlwineventlog
\ No newline at end of file

From 7b8f6b22e2f38627bb5f22143f5fc0a443ced782 Mon Sep 17 00:00:00 2001
From: Xiao Lin <xlin@splunk.com>
Date: Fri, 25 Feb 2022 10:03:01 -0800
Subject: [PATCH 42/52] update search

---
 ...l_volume_download_from_internal_server.yml | 58 ++++++++++---------
 1 file changed, 31 insertions(+), 27 deletions(-)

diff --git a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
index d0260a789b..90af130e1a 100644
--- a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -6,33 +6,37 @@ author: Xiao Lin, Splunk
 type: Anomaly
 datamodel:
 - Network_Traffic
-description: Insider might conduct information collection before data exfiltration,
-  and unusual volume of data download from internal server is an indicator of such
-  potential threat. This detection evaluates the total bytes downloaded from internal
-  servers at specific time window per entity level, and then flagged these that are
-  higher than 99.999% percentile as an anamaly. A behavior will be reported as long
-  as the downloaded byte volume is unusual even though that operation is benigh, which
-  causes false positive. It is therefore advised to adjust threshold and time window
-  based on detection performance whenever necessary. It should be noted that seasonality
-  is not modeled in the current approach.
-search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event,
-  "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope
-  = map_get(input_event, "src_device_scope") | eval dest_device_scope = map_get(input_event,
-  "src_device_scope") | where src_device_scope IS NOT NULL AND dest_device_scope IS
-  NOT NULL | eval dest_device = map_get(input_event, "dest_device_ips") | where dest_device
-  IS NOT NULL AND dest_device_scope == "INTERNAL" | eval src_device = map_get(input_event,
-  "source_device_ips") | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
-  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string",
-  null)) | where download_bytes IS NOT NULL | eval tenant = map_get(input_event, "_tenant"),
-  event_id = map_get(input_event, "event_id") | adaptive_threshold algorithm="quantile"
-  value="download_bytes" entity="dest_device" threshold=0.001 window=86400L | eval
-  end_time = timestamp | eval start_time = end_time - 86400 | eval body = create_map(["event_id",
-  event_id, "tenant", tenant]) | select start_time, end_time, dest_device, label,
-  body | into write_ssa_detected_events();'
-how_to_implement: Ingest PAN traffic logs
-known_false_positives: Benign large volume data download might be flagged as (false)
-  positive.
+description: Insider might conduct information collection before data exfiltration, and unusual volume of data
+  download from internal server is an indicator of such potential threat. This detection evaluates the total 
+  bytes downloaded from internal servers at specific time window per entity level, and then flagged these that 
+  are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte 
+  volume is unusual even though that operation is benign, which causes false positive. It is therefore advised 
+  to adjust threshold and time window based on detection performance whenever necessary. It should be noted that 
+  seasonality is not modeled in the current approach.
+search: '| from read_ssa_enriched_events() 
+  | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null)
+  | eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null))
+  | where sourcetype == "pan:traffic"
+  | eval src_device_scope =ucast(map_get(input_event, "src_device_scope"), "string", null)
+  | eval dest_device_scope=ucast(map_get(input_event, "dest_device_scope"), "string", null)
+  | where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL
+  | eval dest_device = ucast(map_get(input_event, "dest_device_ips"), "collection<string>", [])[0]
+  | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL"
+  | eval src_device  = ucast(map_get(input_event, "src_device_ips"), "collection<string>", [])[0]
+  | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
+  | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer", 0)
+  | eval download_bytes = cast(bytes_in, "double")
+  | eval tenant = ucast(map_get(input_event, "_tenant"), "string", null)
+  | eval event_id = ucast(map_get(input_event, "event_id"), "string", null)
+  | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" window=86400000L
+  | where label AND quantile>0.99999
+  | eval end_time = timestamp
+  | eval start_time = end_time - 86400000
+  | eval body = create_map(["event_id", event_id, "tenant", tenant])
+  | eval entities=mvappend(dest_device)
+  | into write_ssa_detected_events();'
+how_to_implement: Ingest PAN traffic logs 
+known_false_positives: Benign large volume data download might be flagged as (false) positive.
 references:
 - https://github.com/twitter/AnomalyDetection
 tags:

From 9f65b5d0d4ce1d1cb042b16a156b05de5dae7972 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Feb 2022 13:48:04 -0600
Subject: [PATCH 43/52] Updated required fields

---
 .../endpoint/ssa___windows_wsreset_uac_bypass.yml     | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
index 23366f9fd7..7c2e44ce70 100644
--- a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
+++ b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
@@ -7,9 +7,9 @@ type: Anomaly
 datamodel:
 - Endpoint_Registry
 description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
+search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: Unknown at this point in time.
 references:
 - https://github.com/hfiref0x/UACME
 - https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass 
@@ -26,6 +26,13 @@ tags:
   - Splunk Behavioral Analytics
   required_fields:
   - _time
+  - registry_path
+  - registry_hive
+  - registry_value_name
+  - registry_key_name
+  - registry_value_type
+  - registry_value_data
+  - process_guid
   security_domain: endpoint
   impact: 70
   confidence: 90

From d3322283c39eea6c55e4dfe68f832bd0728bb987 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Feb 2022 13:49:21 -0600
Subject: [PATCH 44/52] Added risk_severity

---
 detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml        | 1 +
 .../experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
index fa2ece5a8e..78dc50a0cd 100644
--- a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
+++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
@@ -43,6 +43,7 @@ tags:
   impact: 80
   confidence: 100 
   risk_score: 80
+  risk_severity: high
   context: 
   - Source:Endpoint
   - Stage:Privilege Escalation
diff --git a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
index 7c2e44ce70..68f37f6895 100644
--- a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
+++ b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml
@@ -37,6 +37,7 @@ tags:
   impact: 70
   confidence: 90
   risk_score: 63 
+  risk_severity: medium
   context:
   - Source:Endpoint
   - Stage:Persistence

From 176c3390730cee1cf2c597bb62820d4c139a793c Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Feb 2022 14:22:53 -0600
Subject: [PATCH 45/52] Updated FP

---
 detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
index 78dc50a0cd..1d87d7bca4 100644
--- a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
+++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary.
 search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: None known at this time. 
 references:
 -  https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md

From b7296e551ad20847f6157205a010e8314948c662 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 25 Feb 2022 14:44:58 -0600
Subject: [PATCH 46/52] Added playbook_type field

---
 playbooks/activedirectory_reset_password.yml         | 1 +
 playbooks/aws_disable_user_accounts.yml              | 1 +
 playbooks/aws_find_inactive_users.yml                | 1 +
 playbooks/block_indicators.yml                       | 1 +
 playbooks/crowdstrike_malware_triage.yml             | 1 +
 playbooks/delete_detected_files.yml                  | 1 +
 playbooks/email_notification_for_malware.yml         | 1 +
 playbooks/internal_host_splunk_investigate_log4j.yml | 1 +
 playbooks/internal_host_ssh_investigate.yml          | 1 +
 playbooks/internal_host_ssh_log4j_investigate.yml    | 1 +
 playbooks/internal_host_ssh_log4j_respond.yml        | 1 +
 playbooks/internal_host_winrm_investigate.yml        | 1 +
 playbooks/internal_host_winrm_log4j_investigate.yml  | 1 +
 playbooks/internal_host_winrm_log4j_respond.yml      | 1 +
 playbooks/log4j_investigate.yml                      | 1 +
 playbooks/log4j_respond.yml                          | 1 +
 playbooks/malware_hunt_and_contain.yml               | 1 +
 playbooks/ransomware_investigate_and_contain.yml     | 1 +
 playbooks/risk_notable_block_indicators.yml          | 1 +
 playbooks/risk_notable_enrich.yml                    | 1 +
 playbooks/risk_notable_import_data.yml               | 1 +
 playbooks/risk_notable_investigate.yml               | 1 +
 playbooks/risk_notable_merge_events.yml              | 1 +
 playbooks/risk_notable_mitigate.yml                  | 1 +
 playbooks/risk_notable_preprocess.yml                | 1 +
 playbooks/risk_notable_protect_assets_and_users.yml  | 1 +
 playbooks/risk_notable_review_indicators.yml         | 1 +
 playbooks/risk_notable_verdict.yml                   | 1 +
 playbooks/start_investigation.yml                    | 1 +
 playbooks/threat_intel_investigate.yml               | 1 +
 playbooks/trustar_enrich_indicators.yml              | 1 +
 31 files changed, 31 insertions(+)

diff --git a/playbooks/activedirectory_reset_password.yml b/playbooks/activedirectory_reset_password.yml
index 93bf24ddb3..0586ae5076 100644
--- a/playbooks/activedirectory_reset_password.yml
+++ b/playbooks/activedirectory_reset_password.yml
@@ -12,6 +12,7 @@ app_list:
 - "LDAP"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - compromisedUserName
   product:
diff --git a/playbooks/aws_disable_user_accounts.yml b/playbooks/aws_disable_user_accounts.yml
index c09f103fed..de055065f7 100644
--- a/playbooks/aws_disable_user_accounts.yml
+++ b/playbooks/aws_disable_user_accounts.yml
@@ -14,6 +14,7 @@ app_list:
 tags:
   platform_tags:
   - Cloud
+  playbook_type: Input
   playbook_fields:
   - aws_username
   product:
diff --git a/playbooks/aws_find_inactive_users.yml b/playbooks/aws_find_inactive_users.yml
index 7e0fabfdc3..37580b6093 100644
--- a/playbooks/aws_find_inactive_users.yml
+++ b/playbooks/aws_find_inactive_users.yml
@@ -15,6 +15,7 @@ app_list:
 tags:
   platform_tags:
   - Cloud
+  playbook_type: Automation
   playbook_fields: []
   product:
   - Splunk SOAR
\ No newline at end of file
diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml
index b1686ff23d..bd50121ece 100644
--- a/playbooks/block_indicators.yml
+++ b/playbooks/block_indicators.yml
@@ -14,6 +14,7 @@ app_list:
 - "OpenDNS Umbrella"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - destinationDnsDomain
   - destinationAddress
diff --git a/playbooks/crowdstrike_malware_triage.yml b/playbooks/crowdstrike_malware_triage.yml
index 292b830119..eef531f13f 100644
--- a/playbooks/crowdstrike_malware_triage.yml
+++ b/playbooks/crowdstrike_malware_triage.yml
@@ -12,6 +12,7 @@ app_list:
 - "Crowdstrike OAuth"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - filePath
   - destinationAddress
diff --git a/playbooks/delete_detected_files.yml b/playbooks/delete_detected_files.yml
index 3e41aae6f5..f97a071ab6 100644
--- a/playbooks/delete_detected_files.yml
+++ b/playbooks/delete_detected_files.yml
@@ -16,6 +16,7 @@ tags:
   detections:
   - Executable File Written in Administrative SMB Share
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - filePath
   - destinationAddress
diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml
index 6afbc2d9f8..5327b71a32 100644
--- a/playbooks/email_notification_for_malware.yml
+++ b/playbooks/email_notification_for_malware.yml
@@ -15,6 +15,7 @@ app_list:
 - "SMTP"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - fileHash
   - vaultId
diff --git a/playbooks/internal_host_splunk_investigate_log4j.yml b/playbooks/internal_host_splunk_investigate_log4j.yml
index 59c4fec939..17074df9e5 100644
--- a/playbooks/internal_host_splunk_investigate_log4j.yml
+++ b/playbooks/internal_host_splunk_investigate_log4j.yml
@@ -15,6 +15,7 @@ tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
   platform_tags: []
+  playbook_type: Input
   playbook_fields:
   - hostName
   - destinationAddress
diff --git a/playbooks/internal_host_ssh_investigate.yml b/playbooks/internal_host_ssh_investigate.yml
index 0604c74c52..a76aaa0521 100644
--- a/playbooks/internal_host_ssh_investigate.yml
+++ b/playbooks/internal_host_ssh_investigate.yml
@@ -12,6 +12,7 @@ app_list:
 - "SSH"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR
diff --git a/playbooks/internal_host_ssh_log4j_investigate.yml b/playbooks/internal_host_ssh_log4j_investigate.yml
index 8d63eb9780..ab59dfeb03 100644
--- a/playbooks/internal_host_ssh_log4j_investigate.yml
+++ b/playbooks/internal_host_ssh_log4j_investigate.yml
@@ -12,6 +12,7 @@ app_list:
 - "SSH"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR
diff --git a/playbooks/internal_host_ssh_log4j_respond.yml b/playbooks/internal_host_ssh_log4j_respond.yml
index e42634649b..8a529055fc 100644
--- a/playbooks/internal_host_ssh_log4j_respond.yml
+++ b/playbooks/internal_host_ssh_log4j_respond.yml
@@ -12,6 +12,7 @@ app_list:
 - "SSH"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR
diff --git a/playbooks/internal_host_winrm_investigate.yml b/playbooks/internal_host_winrm_investigate.yml
index 8db5966975..7fdc684799 100644
--- a/playbooks/internal_host_winrm_investigate.yml
+++ b/playbooks/internal_host_winrm_investigate.yml
@@ -12,6 +12,7 @@ app_list:
 - "Windows Remote Management"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR
diff --git a/playbooks/internal_host_winrm_log4j_investigate.yml b/playbooks/internal_host_winrm_log4j_investigate.yml
index d90fc2c6f8..6252cd96ae 100644
--- a/playbooks/internal_host_winrm_log4j_investigate.yml
+++ b/playbooks/internal_host_winrm_log4j_investigate.yml
@@ -12,6 +12,7 @@ app_list:
 - "Windows Remote Management"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR
diff --git a/playbooks/internal_host_winrm_log4j_respond.yml b/playbooks/internal_host_winrm_log4j_respond.yml
index 1987ff3685..8341080187 100644
--- a/playbooks/internal_host_winrm_log4j_respond.yml
+++ b/playbooks/internal_host_winrm_log4j_respond.yml
@@ -12,6 +12,7 @@ app_list:
 - "Windows Remote Management"
 tags:
   platform_tags: []
+  playbook_type: Input
   playbook_fields: []
   product:
   - Splunk SOAR
diff --git a/playbooks/log4j_investigate.yml b/playbooks/log4j_investigate.yml
index 01d648e0a4..25e7e6c816 100644
--- a/playbooks/log4j_investigate.yml
+++ b/playbooks/log4j_investigate.yml
@@ -30,5 +30,6 @@ tags:
   - Log4Shell JNDI Payload Injection with Outbound Connection
   - Detect Outbound LDAP Traffic
   playbook_fields: []
+  playbook_type: Automation
   product:
   - Splunk SOAR
diff --git a/playbooks/log4j_respond.yml b/playbooks/log4j_respond.yml
index ddbb3e6c45..15bd0a34d2 100644
--- a/playbooks/log4j_respond.yml
+++ b/playbooks/log4j_respond.yml
@@ -30,5 +30,6 @@ tags:
   - Log4Shell JNDI Payload Injection with Outbound Connection
   - Detect Outbound LDAP Traffic
   playbook_fields: []
+  playbook_type: Automation
   product:
   - Splunk SOAR
diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml
index 9d60cffa84..8b0e78dfe3 100644
--- a/playbooks/malware_hunt_and_contain.yml
+++ b/playbooks/malware_hunt_and_contain.yml
@@ -15,6 +15,7 @@ app_list:
 - "VirusTotal"
 tags:
   platform_tags: []
+  playbook_type: Automation
   playbook_fields:
   - fileHash
   product:
diff --git a/playbooks/ransomware_investigate_and_contain.yml b/playbooks/ransomware_investigate_and_contain.yml
index 49aaebbb68..13e3766a3a 100644
--- a/playbooks/ransomware_investigate_and_contain.yml
+++ b/playbooks/ransomware_investigate_and_contain.yml
@@ -22,6 +22,7 @@ tags:
   - Conti Common Exec parameter
   platform_tags:
   - Ransomware
+  playbook_type: Automation
   playbook_fields:
   - ComputerName
   - Username
diff --git a/playbooks/risk_notable_block_indicators.yml b/playbooks/risk_notable_block_indicators.yml
index 6edafdbfac..836ae15d21 100644
--- a/playbooks/risk_notable_block_indicators.yml
+++ b/playbooks/risk_notable_block_indicators.yml
@@ -18,6 +18,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:
diff --git a/playbooks/risk_notable_enrich.yml b/playbooks/risk_notable_enrich.yml
index 0b1b6a260e..cc9e59cf7b 100644
--- a/playbooks/risk_notable_enrich.yml
+++ b/playbooks/risk_notable_enrich.yml
@@ -17,6 +17,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:
diff --git a/playbooks/risk_notable_import_data.yml b/playbooks/risk_notable_import_data.yml
index 6fd5db62bf..352f9ed240 100644
--- a/playbooks/risk_notable_import_data.yml
+++ b/playbooks/risk_notable_import_data.yml
@@ -34,6 +34,7 @@ tags:
   - note_content
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   playbook_fields:
   - event_id
   - info_min_time
diff --git a/playbooks/risk_notable_investigate.yml b/playbooks/risk_notable_investigate.yml
index fcdd1261da..cc65a769a2 100644
--- a/playbooks/risk_notable_investigate.yml
+++ b/playbooks/risk_notable_investigate.yml
@@ -14,6 +14,7 @@ app_list:
 tags:
   labels:
   - risk_notable
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:
diff --git a/playbooks/risk_notable_merge_events.yml b/playbooks/risk_notable_merge_events.yml
index bc01af1ae6..1122af6afb 100644
--- a/playbooks/risk_notable_merge_events.yml
+++ b/playbooks/risk_notable_merge_events.yml
@@ -17,6 +17,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:
diff --git a/playbooks/risk_notable_mitigate.yml b/playbooks/risk_notable_mitigate.yml
index 8da0b25461..fd40aaa74f 100644
--- a/playbooks/risk_notable_mitigate.yml
+++ b/playbooks/risk_notable_mitigate.yml
@@ -13,6 +13,7 @@ app_list:
 tags:
   labels:
   - risk_notable
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:
diff --git a/playbooks/risk_notable_preprocess.yml b/playbooks/risk_notable_preprocess.yml
index c90c69d268..f202663f30 100644
--- a/playbooks/risk_notable_preprocess.yml
+++ b/playbooks/risk_notable_preprocess.yml
@@ -20,6 +20,7 @@ tags:
   - risk_notable
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   playbook_fields:
   - event_id
   - info_min_time
diff --git a/playbooks/risk_notable_protect_assets_and_users.yml b/playbooks/risk_notable_protect_assets_and_users.yml
index 5e0814f400..3bd2ecdb38 100644
--- a/playbooks/risk_notable_protect_assets_and_users.yml
+++ b/playbooks/risk_notable_protect_assets_and_users.yml
@@ -16,6 +16,7 @@ tags:
   playbook_outputs:
   - note_title
   - note_content
+  playbook_type: Automation
   platform_tags:
   - Risk Notable
   product:
diff --git a/playbooks/risk_notable_review_indicators.yml b/playbooks/risk_notable_review_indicators.yml
index ed24f18b4b..129d8413d7 100644
--- a/playbooks/risk_notable_review_indicators.yml
+++ b/playbooks/risk_notable_review_indicators.yml
@@ -15,5 +15,6 @@ tags:
   - risk_notable
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   product:
   - Splunk SOAR
diff --git a/playbooks/risk_notable_verdict.yml b/playbooks/risk_notable_verdict.yml
index 6470de0a70..2d90aa3a8d 100644
--- a/playbooks/risk_notable_verdict.yml
+++ b/playbooks/risk_notable_verdict.yml
@@ -15,5 +15,6 @@ tags:
   - risk_notable
   platform_tags:
   - Risk Notable
+  playbook_type: Automation
   product:
   - Splunk SOAR
diff --git a/playbooks/start_investigation.yml b/playbooks/start_investigation.yml
index d6f4890ba2..6d497d8625 100644
--- a/playbooks/start_investigation.yml
+++ b/playbooks/start_investigation.yml
@@ -12,5 +12,6 @@ app_list: []
 tags:
   platform_tags: []
   playbook_fields: []
+  playbook_type: Automation
   product:
   - Splunk SOAR
\ No newline at end of file
diff --git a/playbooks/threat_intel_investigate.yml b/playbooks/threat_intel_investigate.yml
index 65a3095b34..918f813e98 100644
--- a/playbooks/threat_intel_investigate.yml
+++ b/playbooks/threat_intel_investigate.yml
@@ -13,6 +13,7 @@ app_list: []
 tags:
   platform_tags:
   - threat_intel
+  playbook_type: Automation
   playbook_fields: []
   product:
   - Splunk SOAR
\ No newline at end of file
diff --git a/playbooks/trustar_enrich_indicators.yml b/playbooks/trustar_enrich_indicators.yml
index 62e2d30c7e..5cd35f9aa0 100644
--- a/playbooks/trustar_enrich_indicators.yml
+++ b/playbooks/trustar_enrich_indicators.yml
@@ -15,6 +15,7 @@ tags:
   platform_tags:
   - threat_intel
   - risk_notable
+  playbook_type: Input
   playbook_fields: 
   - indicators
   product:

From 3a0e77912f9ceee88986d8a2da32996240b3a1f8 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Feb 2022 16:02:03 -0600
Subject: [PATCH 47/52] Update container_merge

---
 playbooks/custom_functions/container_merge.json | 6 +++---
 playbooks/custom_functions/container_merge.py   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/playbooks/custom_functions/container_merge.json b/playbooks/custom_functions/container_merge.json
index 9ea4df87bc..c6ac131e42 100644
--- a/playbooks/custom_functions/container_merge.json
+++ b/playbooks/custom_functions/container_merge.json
@@ -1,6 +1,6 @@
 {
-    "create_time": "2021-10-18T12:31:32.500833+00:00",
-    "custom_function_id": "83776ecf4dd52c71d8497cb500dd332780eb9c72",
+    "create_time": "2022-02-25T14:52:47.172543+00:00",
+    "custom_function_id": "1f8ae8e7978b750272fbbaba5efe4e6127a9a6a7",
     "description": "An alternative to the add-to-case API call. This function will copy all artifacts, automation, notes and comments over from every container within the container_list into the target_container. The target_container will be upgraded to a case.\n\nThe notes will be copied over with references to the child containers from where they came. A note will be left in the child containers with a link to the target container. The child containers will be marked as evidence within the target container. \n\nAny notes left as a consequence of the merge process will be skipped in subsequent merges.",
     "draft_mode": false,
     "inputs": [
@@ -36,6 +36,6 @@
         }
     ],
     "outputs": [],
-    "platform_version": "5.0.1.66250",
+    "platform_version": "5.2.1.78411",
     "python_version": "3"
 }
\ No newline at end of file
diff --git a/playbooks/custom_functions/container_merge.py b/playbooks/custom_functions/container_merge.py
index c301bbb310..49cbcce3bf 100644
--- a/playbooks/custom_functions/container_merge.py
+++ b/playbooks/custom_functions/container_merge.py
@@ -162,7 +162,7 @@ def container_merge(target_container=None, container_list=None, workbook=None, c
     # Fetch any previous merge note
     params = {'_filter_container': '"{}"'.format(container['id']), '_filter_title': '"[Auto-Generated] Child Containers"'}
     note_url = phantom.build_phantom_rest_url('note')
-    response_data = phantom.requests.get(note_url, verify=False).json()
+    response_data = phantom.requests.get(note_url, params=params, verify=False).json()
     # If an old note was found, proceed to overwrite it
     if response_data['count'] > 0:
         note_item = response_data['data'][0]

From 0d0076a686c022349f495b462d6589a65c2b2ac5 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Mon, 28 Feb 2022 16:02:33 -0600
Subject: [PATCH 48/52] Update find_related_containers

---
 .../custom_functions/find_related_containers.json    |  6 +++---
 .../custom_functions/find_related_containers.py      | 12 +++---------
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/playbooks/custom_functions/find_related_containers.json b/playbooks/custom_functions/find_related_containers.json
index 1ae234becf..30aeb111f7 100644
--- a/playbooks/custom_functions/find_related_containers.json
+++ b/playbooks/custom_functions/find_related_containers.json
@@ -1,6 +1,6 @@
 {
-    "create_time": "2021-10-07T15:52:23.940165+00:00",
-    "custom_function_id": "24c4ef5ecd259674a07cd3c747f4223f09b5dd8f",
+    "create_time": "2022-02-10T18:24:50.244936+00:00",
+    "custom_function_id": "5781e3d5a4773b2c48afd429768fd81b5e733e54",
     "description": "Takes a provided list of indicator values to search for and finds all related containers. It will produce a list of the related container details.",
     "draft_mode": false,
     "inputs": [
@@ -113,6 +113,6 @@
             "description": "Link to container"
         }
     ],
-    "platform_version": "5.0.1.66250",
+    "platform_version": "5.2.1.78411",
     "python_version": "3"
 }
\ No newline at end of file
diff --git a/playbooks/custom_functions/find_related_containers.py b/playbooks/custom_functions/find_related_containers.py
index 749842d4dd..4fd6bea923 100644
--- a/playbooks/custom_functions/find_related_containers.py
+++ b/playbooks/custom_functions/find_related_containers.py
@@ -96,7 +96,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
         filter_in_case = True
     
     # If value list is equal to * then proceed to grab all indicator records for the current container
-    if isinstance(value_list, list) and value_list[0] == "*":
+    if value_list and (isinstance(value_list, list) and "*" in value_list) or (isinstance(value_list, str) and value_list == "*"):
         new_value_list = []
         url = phantom.build_phantom_rest_url('container', current_container, 'artifacts') + '?page_size=0'
         response_data = phantom.requests.get(uri=url, verify=False).json().get('data')
@@ -127,15 +127,10 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
     for indicator_id in list(set(indicator_id_list)):
         params = {'indicator_ids': indicator_id}
         response_data = phantom.requests.get(indicator_common_container_url, params=params, verify=False).json()
+        
         # Populate an indicator dictionary where the original ids are the dictionary keys and the                     
         # associated continers are the values
         if response_data:
-            # Quit early if no related containers were found
-            if len(response_data) == 1 and response_data[0].get('container_id') == current_container:
-                phantom.debug(f"No related containers found for provided values: '{value_list}'")
-                assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
-                return outputs
-            
             indicator_id_dictionary[str(indicator_id)] = []
             for item in response_data:
                 # Append all related containers except for current container
@@ -167,8 +162,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
 
             # Gather container data
             params = {'page_size': 0}
-            if offset_time:
-                params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"'
+            params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"'
             containers_response = phantom.requests.get(uri=container_url, params=params, verify=False).json()
             all_container_dictionary = {}
             if containers_response['count'] > 0:

From 8d72fd87fc5f2198233b9830e92b3c062520bc2f Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 28 Feb 2022 17:02:50 -0500
Subject: [PATCH 49/52] testing new detection logic to avoid FP

---
 ..._distinct_processes_created_in_windows_temp_folder.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
index 31e7e9cd42..986e23feaf 100644
--- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
+++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
@@ -1,8 +1,8 @@
 name: Excessive number of distinct processes created in Windows Temp folder
 id: 23587b6a-c479-11eb-b671-acde48001122
-version: 1
-date: '2021-06-03'
-author: Michael Hart, Splunk
+version: 2
+date: '2022-02-28'
+author: Michael Hart, Mauricio Velazco, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
@@ -13,7 +13,7 @@ description: This analytic will identify suspicious series of process executions
   to typical application behaviors that use Windows\Temp.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   distinct_count(Processes.process) as distinct_process_count  min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path
   = "*\\Windows\\Temp\\*" by Processes.dest Processes.user  _time span=20m | where
   distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter`'

From 63dcb7f00fb89c42ce0df99c9e334a3e66d88614 Mon Sep 17 00:00:00 2001
From: Marc Schwede <9077622+schwedenmut@users.noreply.github.com>
Date: Tue, 1 Mar 2022 14:04:36 +0100
Subject: [PATCH 50/52] Update o365_excessive_authentication_failures_alert.yml

rename syntax adjusted
later needed lastTime included
---
 .../cloud/o365_excessive_authentication_failures_alert.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml
index 65dece8106..f778569c34 100644
--- a/detections/cloud/o365_excessive_authentication_failures_alert.yml
+++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml
@@ -8,7 +8,7 @@ datamodel: []
 description: This search detects when an excessive number of authentication failures
   occur this search also includes attempts against MFA prompt codes
 search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
-  | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod 
+  | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod 
   values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
   | where count > 10 
   | `security_content_ctime(firstTime)` 

From 49b2b9f0d443931794f61b9db6875fe3ec2cdc0a Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 1 Mar 2022 11:19:55 -0600
Subject: [PATCH 51/52] Updated ransomware_extensions.csv

---
 lookups/ransomware_extensions.csv | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv
index abe2c6ca7c..7ff10c3a45 100644
--- a/lookups/ransomware_extensions.csv
+++ b/lookups/ransomware_extensions.csv
@@ -28,7 +28,6 @@ Extensions,Name
 .bitstak,BitStak
 .Silent,BlackShades Crypter
 .blocatto,Blocatto
-.lock,Brazilian
 .cry,Central Security Treatment Organization
 .cerber,Cerber
 .cerber2,Cerber
@@ -299,4 +298,4 @@ Extensions,Name
 .FUSION,Fusion
 .MILIHPEN,Milihpen
 .GANGBANG,Gangbang
-.reddot,RedDot
\ No newline at end of file
+.reddot,RedDot

From 10ed4439039e089baffce3bac531155954dbac7b Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 1 Mar 2022 09:41:19 -0800
Subject: [PATCH 52/52] Ensuring that testing code from develop branch is
 always used for CI/CD.  This is done by explicitly checking out the develop
 branch to get the testing code.  We make this change to avoid doing CI/CD
 tests using out-of-data Splunkbase Apps. For one-off testing, a develop can
 always modify this workflow file to NOT check out the develop branch and
 include a custom test JSON.

---
 .github/workflows/detection-testing.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 98ee2d736a..3d150e6206 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -50,6 +50,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
       
 
@@ -137,6 +139,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2
@@ -194,6 +198,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
+          with:
+            ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2