From b5dfe4450f7cb4fe8ed868c565ebd02e157d96bb Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 17 Nov 2020 16:32:59 -0500 Subject: [PATCH 1/3] removing a broken detection --- .../windows_connhost_exe_force_flag.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) rename detections/{endpoint => deprecated}/windows_connhost_exe_force_flag.yml (86%) diff --git a/detections/endpoint/windows_connhost_exe_force_flag.yml b/detections/deprecated/windows_connhost_exe_force_flag.yml similarity index 86% rename from detections/endpoint/windows_connhost_exe_force_flag.yml rename to detections/deprecated/windows_connhost_exe_force_flag.yml index d238f63107..8abbf3ed30 100644 --- a/detections/endpoint/windows_connhost_exe_force_flag.yml +++ b/detections/deprecated/windows_connhost_exe_force_flag.yml @@ -3,7 +3,10 @@ id: c114aaca-68ee-41c2-ad8c-32bf21db8769 version: 1 date: '2020-11-06' description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. -This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.' +This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. +DEPRECATED +This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk. +' how_to_implement: You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which From 029edcc184d68a660bd29ec337ba0cbfcd675b2a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 18 Nov 2020 14:02:50 +0000 Subject: [PATCH 2/3] Bump botocore from 1.19.19 to 1.19.20 Bumps [botocore](https://github.com/boto/botocore) from 1.19.19 to 1.19.20. - [Release notes](https://github.com/boto/botocore/releases) - [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/botocore/compare/1.19.19...1.19.20) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 68057a7878..7ab4d4219b 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -6,7 +6,7 @@ atomicwrites==1.4.0 attackcti==0.3.3 attrs==20.3.0 bcrypt==3.2.0 -botocore==1.19.19 +botocore==1.19.20 certifi==2019.11.28 boto3==1.16.19 cffi==1.14.3 From b0f36aba0b9bbce399c7823c1d69f328ab627b13 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 18 Nov 2020 14:07:45 +0000 Subject: [PATCH 3/3] Bump boto3 from 1.16.19 to 1.16.20 Bumps [boto3](https://github.com/boto/boto3) from 1.16.19 to 1.16.20. - [Release notes](https://github.com/boto/boto3/releases) - [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/boto3/compare/1.16.19...1.16.20) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 7ab4d4219b..ad484f9d34 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -8,7 +8,7 @@ attrs==20.3.0 bcrypt==3.2.0 botocore==1.19.20 certifi==2019.11.28 -boto3==1.16.19 +boto3==1.16.20 cffi==1.14.3 cfgv==2.0.1 chardet==3.0.4