Branch was auto-updated.

.gitlab-ci.yml

@@ -2,6 +2,9 @@ default:
   image: docker-hub.repo.splunkdev.net/python:3.9
 
 variables:
+  EXTRACTO_VERSION:
+    value: "1.0.60"
+    description: "The version of extracto to use"
   SKIP_DOWNSTREAM_TESTING:
     value: "False"
     description: "If true, downstream testing will be suppressed (useful for debugging or forcing a release in an emergency)."
@@ -9,8 +12,8 @@ variables:
 stages:
   - validate
   - generate
-  - app_inspect
   - test
+  - app_inspect
   - release
 
 include:

README.md

@@ -25,103 +25,53 @@ Welcome to the Splunk Security Content
 
 This project gives you access to our repository of Analytic Stories, security guides that provide background on tactics, techniques and procedures (TTPs), mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
 
+**Note:** We have sister projects that enable us to build the industry's best security content. These projects are the Splunk Attack Range, an attack simulation lab built around Splunk, and Contentctl, the tool that enables us to build, test, and package our content for distribution.
+
+- [Splunk Attack Range](https://github.com/splunk/attack_range): An attack simulation lab built around Splunk.
+- [Contentctl](https://github.com/splunk/contentctl): The tool that enables us to build, test, and package our content for distribution.
+
 # Get Content🛡
 The latest Splunk Security Content can be obtained via:
+ 
+### 🌐 [Website](https://www.notion.so/Splunk-c0afd5a0c59242a19f7ab555630b493d?pvs=21)
 
-#### [SSE App](https://splunkbase.splunk.com/app/3435/)
-Grab the latest release of Splunk Security Essentials App and install it on a Splunk instance. You can download it from [splunkbase](https://splunkbase.splunk.com/app/3435/), it is a Splunk Supported App. SSE Splunk app today supports push updates for security content release, this is the **preferred way** to get content!
+Best way to discover and access our content is by using the [research.splunk.com](https://research.splunk.com/) website.
 
-#### [ESCU App](https://github.com/splunk/security_content/releases)
-Grab the latest release of DA-ESS-ContentUpdate.spl and install it on a Splunk instance. Alternatively, you can download it from [splunkbase](https://splunkbase.splunk.com/app/3449/), it is currently a Splunk Supported App.
+### 🖥️ [Splunk Enterprise Security (ES) Content Update](https://docs.splunk.com/Documentation/ES/latest/Admin/Usecasecontentlibrary?#Update_the_Analytic_Stories)
 
-#### [API](https://docs.splunkresearch.com/?version=latest)
-```
-curl -s https://content.splunkresearch.com | jq
-{
-  "hello": "welcome to Splunks Research security content api"
-}
-```
+Splunk security content ships as part of ESCU directly into, if you are an ES user, good news, you already have it!
 
-# Usage 🧰
-### contentctl.py
-The Content Control tool allows you to manipulate Splunk Security Content via the following actions:
+### 📦 [ESCU App](https://github.com/splunk/security_content/releases)
 
-0. **init** - Initilialize a new repo from scratch so you can easily add your own content to a custom application.  Note that this requires a large number of command line arguments, so use python _contentctl.py init --help_ for documentation around those arguments.
-1. **new_content** - Creates new content (detection, story, baseline)
-2. **validate** - Validates written content
-3. **generate** - Generates a deployment package for different platforms (splunk_app)
-4. **build** - Builds an application suitable for deployment on a search head using Slim, the Splunk Packaging Toolkit
-5. **inspect** - Uses a local version of appinspect to ensure that the app you built meets basic quality standards.
-6. **cloud_deploy** - Using ACS, deploy your custom app to a running Splunk Cloud Instance.
-7. **convert** - Convert a detection rule with sigma syntax to a Splunk SPL detection
-8. **content_changer** - Perform changes on security content
+To manually download the latest release of Splunk Security Content (named DA-ESS-ContentUpdate.spl), you can visit the [splunkbase](https://splunkbase.splunk.com/app/3449/) page or the [release page](https://github.com/splunk/security_content/releases) on GitHub.
 
-### pre-requisites
-Make sure you use python version 3.9.
+# Tools 🧰
+The key tool that drives our content development is [contentctl](https://github.com/splunk/contentctl). Contentctl offers the following features:
 
-```
-git clone git@github.com:splunk/security_content.git
-cd security_content
-pip install virtualenv
-virtualenv venv
-source venv/bin/activate
-pip install -r requirements.txt
-```
-### Architecture details for the tooling
-- [WIKI](https://github.com/splunk/security_content/wiki/Security-Content-Code)
-
-### create a new detection
-`python contentctl.py -p . new_content -t detection`
-
-for a more indepth write up on how to write content see our [guide](https://github.com/splunk/security_content/wiki/Developing-Content).
-
-### validate security content
-`python contentctl.py -p . validate -pr ESCU`
-
-### generate a splunk app from current content
-`python contentctl.py -p . generate -o dist/escu -pr ESCU`
-
-### convert a Sigma search into a Splunk detection
-Detection rule using tstats and cim datamodel:
-`python contentctl.py -p . convert -dm cim -o detections/endpoint/ -dp dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml`
-
-Detection rule using raw:
-`python contentctl.py -p . convert -dm raw -o detections/endpoint/ -dp dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml`
-
-Detection rule converted to Windows Security Event Code 4688:
-`python contentctl.py -p . convert -dm raw -lo "Windows Security 4688" -o detections/endpoint/ -dp dev/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml`
-
-### perform changes on security content
-Content changer will perform a change function defined in [here](https://github.com/splunk/security_content/blob/add_content_changer/bin/contentctl_project/contentctl_core/application/use_cases/content_changer.py) on all content or the content defined through the filter condition:
-`python contentctl.py -p detections/endpoint content_changer --change_function update_description --filter_key name --filter_value "3CX Supply Chain Attack Network Indicators" "Hello World"`
+- Creating new detections
+- Validating the correctness of all necessary components for detections
+- Testing detections
+- Generating deployable apps from detections
 
+To learn more about contentctl and its capabilities, please visit the [contentctl repository](https://github.com/splunk/contentctl).
 
 # MITRE ATT&CK ⚔️
 ### Detection Coverage
-To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
+To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for.
 
 ![](docs/mitre-map/coverage.png)
 
-# Customize to your Environment 🏗
-Customize your content to change how [often detections run](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-scheduling-and-alert-actions-with-deployments), or what the right source type for [sysmon](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment#customizing-source-types-with-macros) in your environment is please follow this [guide](https://github.com/splunk/security_content/wiki/Customize-to-Your-Environment).  
-
-# What's in an Analytic Story? 🗺
-A complete use case, specifically built to detect, investigate, and respond to a specific threat like [Credential Dumping](https://github.com/splunk/security_content/blob/develop/stories/credential_dumping.yml) or [Ransomware](https://github.com/splunk/security_content/blob/develop/stories/ransomware.yml). A group of detections and a response make up an analytic story, they are associated with the tag `analytic_story: <name>`.  
-
 # Content Parts 🧩
 
-* [detections/](detections/): Contains all 209 detection searches to-date and growing.
+* [detections/](detections/): Contains all detection searches to-date and growing.
 * [stories/](stories/): All Analytic Stories that are group detections or also known as Use Cases
 * [deployments/](deployments/): Configuration for the schedule and alert action for all content
 * [playbooks/](playbooks/): Incident Response Playbooks/Workflow for responding to a specific Use Case or Threat.
 * [baselines/](baselines/): Searches that must be executed before a detection runs. It is specifically useful for collecting data on a system before running your detection on the collected data.
-* [investigations/](investigations/): Investigations to further analysis the output from detections.
-* [dashboards/](dashboards/): JSON definitions of Mission Control dashboards, to be used as a response task. Currently not used.
+* [investigations/](investigations/): Investigations to further analyze the output from detections. For more information, you can refer to the [Splunk Enterprise Security documentation on timelines](https://docs.splunk.com/Documentation/ES/7.3.0/User/Timelines).
 * [macros/](macros/): Implements Splunk’s search macros, shortcuts to commonly used search patterns like sysmon source type. More on how macros are used to customize content below.
 * [lookups/](lookups/): Implements Splunk’s lookup, usually to provide a list of static values like commonly used ransomware extensions.
-* [security_content_automation/](security_content_automation/): It contains script for enriching detection with relevant supported TAs and also contains script for publishing release build to [Pre-QA artifactory](https://repo.splunk.com/artifactory/Solutions/DA/Pre-QA/) on every tag release.
-
-
+* [data_sources/](data_sources/): Defines the data sources, the necessary TA or App to collect them and the fields provided that can be used by the detections.
 
 # Contribution 🥰
 We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved.
@@ -136,8 +86,6 @@ If you have questions or need support, you can:
 * Post a question to [Splunk Answers](http://answers.splunk.com)
 * Join the [#security-research](https://splunk-usergroups.slack.com/archives/C1S5BEF38) room in the [Splunk Slack channel](http://splunk-usergroups.slack.com)
 
-
-
 ## License
 Copyright 2022 Splunk Inc.
 

contentctl.yml

@@ -6,7 +6,7 @@ build:
   path_root: dist
   prefix: ESCU
   build: 004210
-  version: 4.25.0
+  version: 4.26.0
   label: ES Content Updates
   author_name: Splunk Threat Research Team
   author_email: research@splunk.com

detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml

@@ -1,8 +1,8 @@
-name: AWS AMI Atttribute Modification for Exfiltration
+name: AWS AMI Attribute Modification for Exfiltration
 id: f2132d74-cf81-4c5e-8799-ab069e67dc9f
 version: 2
 date: '2023-03-31'
-author: BHavin Patel, Splunk
+author: Bhavin Patel, Splunk
 status: production
 type: TTP
 data_source: []
@@ -12,7 +12,7 @@ search: '`cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPe
 |  rename requestParameters.launchPermission.add.items{}.userId as accounts_added
  | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")  | stats
   count min(_time) as firstTime max(_time) as lastTime  values(group_added) values(accounts_added) as accounts_added values(ami_status) by  src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId 
-|  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_atttribute_modification_for_exfiltration_filter`'
+|  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_attribute_modification_for_exfiltration_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS admin has legitimately shared a

detections/cloud/aws_iam_delete_policy.yml

@@ -5,7 +5,7 @@ date: '2021-04-01'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
-description: The following detection identifes when a policy is deleted on AWS. This
+description: The following detection identifies when a policy is deleted on AWS. This
   does not identify whether successful or failed, but the error messages tell a story
   of suspicious attempts. There is a specific process to follow when deleting a policy.
   First, detach the policy from all users, groups, and roles that the policy is attached

detections/cloud/cloud_security_groups_modifications_by_user.yml

@@ -0,0 +1,65 @@
+name: Cloud Security Groups Modifications by User
+id: cfe7cca7-2746-4bdf-b712-b01ed819b9de
+version: 1
+date: '2024-02-21'
+author: Bhavin Patel, Splunk 
+data_source: []
+type: Anomaly
+status: production
+description: The following analytic identifies users who are unsually modifying security group in your cloud enriovnment,focusing on actions such as modifications, deletions, or creations performed by users over 30-minute intervals. Analyzing patterns of modifications to security groups can help in identifying anomalous behavior that may indicate a compromised account or an insider threat.\
+
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\
+
+  This detection will only trigger on all user and service accounts that have created/modified/deleted a security group .\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and values of the security objects affected.
+search: '| tstats dc(All_Changes.object) as unique_security_groups values(All_Changes.src) as src values(All_Changes.user_type) as user_type values(All_Changes.object_category) as object_category values(All_Changes.object) as objects
+    values(All_Changes.action) as action  values(All_Changes.user_agent) as user_agent values(All_Changes.command) as command from datamodel=Change WHERE All_Changes.object_category = "security_group" (All_Changes.action = modified OR All_Changes.action = deleted OR All_Changes.action = created)  by All_Changes.user  _time span=30m 
+|  `drop_dm_object_name("All_Changes")` 
+| eventstats avg(unique_security_groups) as avg_changes
+    , stdev(unique_security_groups) as std_changes by user 
+| eval upperBound=(avg_changes+std_changes*3) 
+| eval isOutlier=if(unique_security_groups > 2 and unique_security_groups >= upperBound, 1, 0) 
+| where isOutlier=1| `cloud_security_groups_modifications_by_user_filter`'
+how_to_implement: This search requries the Cloud infrastructure logs such as AWS Cloudtrail, GCP Pubsub Message logs, Azure Audit logs to be ingested into an accelerated Change datamodel. It is also recommended that users can try different combinations of the `bucket` span time and outlier conditions to better suit with their environment. 
+known_false_positives: It is possible that legitimate user/admin may modify a number of security groups  
+references:
+- https://attack.mitre.org/techniques/T1578/005/
+tags:
+  analytic_story:
+  - Suspicious Cloud User Activities
+  asset_type: Cloud Instance
+  confidence: 50
+  impact: 70
+  message:  Unsual number cloud security group modifications detected by user - $user$
+  mitre_attack_id:
+  - T1578.005
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.object_category
+  - All_Changes.user
+  risk_score: 35
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1578.005/aws_authorize_security_group/aws_authorize_security_group.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail

detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml

@@ -7,7 +7,7 @@ status: production
 type: TTP
 data_source: []
 description: This analytic identifies instances where multiple users (more than 10 unique accounts) have failed to authenticate from a single IP address within a short time span (5 minutes). Such a pattern can be indicative of malicious activities, such as brute-force attacks or password spraying attempts. The detection leverages O365 audit logs, specifically focusing on Azure Active Directory login failures (AzureActiveDirectoryStsLogon). By aggregating these failures based on the source IP address and time, the analytic captures patterns where multiple unique user accounts have authentication failures from the same IP within a 5-minute window. Multiple authentication failures from a single IP address targeting various accounts can be a strong indicator of an attacker trying to gain unauthorized access. It could represent a brute-force attack, password spraying, or other malicious login attempts. Identifying and responding to such patterns promptly is crucial to prevent potential account compromises and unauthorized access to organizational resources. If the detection is a true positive, it suggests that an external entity is actively trying to breach the security by targeting multiple user accounts. While the attempts have been unsuccessful (as indicated by the login failures), it's a clear sign of malicious intent. Immediate action is required to block or monitor the suspicious IP, investigate the nature of the attempts, and potentially notify affected users to take precautionary measures like password changes or enabling multi-factor authentication.
-search: ' `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon 
+search: ' `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126 
   |  bucket span=5m _time
   |  stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent by _time, src_ip
   |  where unique_accounts > 10
@@ -52,6 +52,7 @@ tags:
   - LogonError
   - signature
   - UserAgent
+  - ErrorNumber
   security_domain: identity
 tests:
 - name: True Positive Test

detections/endpoint/detect_remote_access_software_usage_file.yml

@@ -0,0 +1,65 @@
+name: Detect Remote Access Software Usage File
+id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
+version: 1
+date: '2024-02-22'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when a file from a known remote access software is written to disk within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+data_source:
+- Sysmon Event ID 11
+- Sysmon Event ID 15
+search: '| tstats `security_content_summariesonly` count, min(_time) as firstTime, max(_time) as lastTime, values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.dest, Filesystem.user, Filesystem.file_name
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Filesystem)` 
+  | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category
+  | search isutility = TRUE
+  | `detect_remote_access_software_usage_file_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Known or approved applications used by the organization or usage of built-in functions.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command And Control
+  - Ransomware
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
+  mitre_attack_id:
+  - T1219
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest 
+  - Filesystem.user
+  - Filesystem.file_name
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/detect_remote_access_software_usage_fileinfo.yml

@@ -0,0 +1,63 @@
+name: Detect Remote Access Software Usage FileInfo
+id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454
+version: 1
+date: '2024-02-22'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when process with file or code signing attributes from a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+data_source:
+- Sysmon Event ID 1
+search: '`sysmon` EventCode=1
+  | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product by dest, user, parent_process_name, process_name, process
+  | lookup remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category
+  | search isutility = True
+  | `detect_remote_access_software_usage_fileinfo_filter`'
+how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk.
+known_false_positives: Known or approved applications used by the organization or usage of built-in functions.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command And Control
+  - Ransomware
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A file attributes for known a remote access software [$process_name$] was detected on $dest$
+  mitre_attack_id:
+  - T1219
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - EventCode
+  - Company
+  - Product
+  - user
+  - parent_process_name
+  - process_name
+  - process 
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/detect_remote_access_software_usage_process.yml

@@ -0,0 +1,77 @@
+name: Detect Remote Access Software Usage Process
+id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
+version: 1
+date: '2024-02-22'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when a known remote access software is executed within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+data_source:
+- Sysmon Event ID 1
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.process!=unknown by Processes.dest Processes.user Processes.process_name Processes.process 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` 
+  | lookup remote_access_software remote_utility AS process_name OUTPUT isutility, description as signature, comment_reference as desc, category
+  | search isutility = True
+  | `detect_remote_access_software_usage_process_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: It is possible that legitimate remote access software is used
+  within the environment. Ensure that the lookup is reviewed and updated with any
+  additional remote access software that is used within the environment.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command And Control
+  - Ransomware
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A process for a known remote access software $process_name$ was identified on $dest$.
+  mitre_attack_id:
+  - T1219
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest 
+  - Processes.user
+  - Processes.process_name 
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_name
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_multiple_account_passwords_changed.yml

@@ -0,0 +1,58 @@
+name: Windows Multiple Account Passwords Changed
+id: faefb681-14be-4f0d-9cac-0bc0160c7280
+version: 1
+date: '2024-02-20'
+author: Mauricio Velazco, Splunk
+data_source: []
+type: TTP
+status: production
+description: This Splunk detection identifies situations where over five unique Windows account passwords are changed within a 10-minute interval, captured by Event Code 4724 in the Windows Security Event Log. The query utilizes the wineventlog_security dataset, organizing data into 10-minute periods to monitor the count and distinct count of TargetUserName, the accounts with altered passwords. Rapid password changes across multiple accounts are atypical and might indicate unauthorized access or an internal actor compromising account security. Teams should calibrate the detection's threshold and timeframe to fit their specific operational context.
+search: ' `wineventlog_security` EventCode=4724 status=success
+  | bucket span=10m _time
+  | stats count dc(user) as unique_users values(user) as user by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID
+  | where unique_users > 5
+  | `windows_multiple_account_passwords_changed_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events with the Windows TA. The Advanced Security Audit policy setting
+  `Audit User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1098/
+tags:
+  analytic_story:
+  - Azure Active Directory Persistence
+  asset_type: Endpoint
+  confidence: 60
+  impact: 40
+  message: User $src_user$ changed the passwords of multiple accounts in a short period of time.
+  mitre_attack_id:
+  - T1098
+  - T1078
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - success
+  - TargetUserName
+  - SubjectUserName
+  - src_user
+  - SubjectDomainName
+  - TargetDomainName
+  - Logon_ID
+  - user
+  risk_score: 24
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/windows_multiple_passwords_changed.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_multiple_accounts_deleted.yml

@@ -0,0 +1,58 @@
+name: Windows Multiple Accounts Deleted
+id: 49c0d4d6-c55d-4d3a-b3d5-7709fafed70d
+version: 1
+date: '2024-02-21'
+author: Mauricio Velazco, Splunk
+data_source: []
+type: TTP
+status: production
+description: The following analytic flags when more than five unique Windows accounts are deleted within a 10-minute period, identified by Event Code 4726 in the Windows Security Event Log. Using the wineventlog_security dataset, it segments data into 10-minute intervals to monitor account deletions, a pattern that could suggest malicious intent like an attacker erasing traces. Teams should adjust the detection's threshold and timeframe to suit their specific environment.
+search: ' `wineventlog_security` EventCode=4726 status=success
+  | bucket span=10m _time
+  | stats count dc(user) as unique_users values(user) as user by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID
+  | where unique_users > 5
+  | `windows_multiple_accounts_deleted_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events with the Windows TA. The Advanced Security Audit policy setting
+  `Audit User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1098/
+tags:
+  analytic_story:
+  - Azure Active Directory Persistence
+  asset_type: Endpoint
+  confidence: 60
+  impact: 30
+  message: User $src_user$ deleted multiple accounts in a short period of time.
+  mitre_attack_id:
+  - T1098
+  - T1078
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - success
+  - TargetUserName
+  - SubjectUserName
+  - src_user
+  - SubjectDomainName
+  - TargetDomainName
+  - Logon_ID
+  - user
+  risk_score: 18
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/windows_multiple_accounts_deleted.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_multiple_accounts_disabled.yml

@@ -0,0 +1,58 @@
+name: Windows Multiple Accounts Disabled
+id: 5d93894e-befa-4429-abde-7fc541020b7b
+version: 1
+date: '2024-02-21'
+author: Mauricio Velazco, Splunk
+data_source: []
+type: TTP
+status: production
+description: This Splunk detection focuses on instances where more than five unique Windows accounts are disabled within a 10-minute window, as indicated by Event Code 4725 in the Windows Security Event Log. The query analyzes the wineventlog_security dataset, grouping data into 10-minute segments, and tracks the count and distinct count of TargetUserName, the accounts being disabled. This pattern of disabling multiple accounts rapidly is unusual and could signal internal policy breaches or an external attacker's attempt to disrupt normal operations. Teams are advised to tailor the threshold and timeframe of this detection to their environment's specifics
+search: ' `wineventlog_security` EventCode=4725 status=success
+  | bucket span=10m _time
+  | stats count dc(user) as unique_users values(user) as user by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID
+  | where unique_users > 5
+  | `windows_multiple_accounts_disabled_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events with the Windows TA. The Advanced Security Audit policy setting
+  `Audit User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1098/
+tags:
+  analytic_story:
+  - Azure Active Directory Persistence
+  asset_type: Endpoint
+  confidence: 60
+  impact: 30
+  message: User $src_user$ disabled multiple accounts in a short period of time.
+  mitre_attack_id:
+  - T1098
+  - T1078
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - success
+  - TargetUserName
+  - SubjectUserName
+  - src_user
+  - SubjectDomainName
+  - TargetDomainName
+  - Logon_ID
+  - user
+  risk_score: 18
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/windows_multiple_accounts_disabled.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/network/detect_remote_access_software_usage_dns.yml

@@ -0,0 +1,61 @@
+name: Detect Remote Access Software Usage DNS
+id: a16b797d-e309-41bd-8ba0-5067dae2e4be
+version: 1
+date: '2024-02-22'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when a known remote access software domains are contacted from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+data_source:
+- Sysmon Event ID 22
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution by DNS.src DNS.query
+  | `drop_dm_object_name("DNS")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | lookup remote_access_software remote_domain AS query OUTPUT isutility, description as signature, comment_reference as desc, category
+  | eval dest = query
+  | search isutility = True
+  | `detect_remote_access_software_usage_dns_filter`'
+how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command And Control
+  - Ransomware
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A domain for a known remote access software $query$ was contacted by $src$.
+  mitre_attack_id:
+  - T1219
+  observable:
+  - name: src
+    type: Hostname
+    role:
+    - Victim
+  - name: query
+    type: Hostname
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.src
+  - DNS.query
+  - DNS.answer
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/network/detect_remote_access_software_usage_traffic.yml

@@ -0,0 +1,58 @@
+name: Detect Remote Access Software Usage Traffic
+id: 885ea672-07ee-475a-879e-60d28aa5dd42
+version: 1
+date: '2024-02-22'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when a known remote access software application traffic is detected from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+data_source: []
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(user) as user from datamodel=Network_Traffic by All_Traffic.src All_Traffic.dest, All_Traffic.app
+  | `drop_dm_object_name("All_Traffic")` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category
+  | search isutility = True
+  | `detect_remote_access_software_usage_traffic_filter`'
+how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+- https://applipedia.paloaltonetworks.com/
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command And Control
+  - Ransomware
+  asset_type: Network
+  confidence: 50
+  impact: 50
+  message: Application traffic for a known remote access software [$signature$] was detected from $src$.
+  mitre_attack_id:
+  - T1219
+  observable:
+  - name: src
+    type: Hostname
+    role:
+    - Victim   
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Traffic.src
+  - All_Traffic.dest
+  - All_Traffic.app
+  - All_Traffic.dest_port
+  - user
+  risk_score: 25
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo_traffic.log
+    source: screenconnect_palo_traffic
+    sourcetype: pan:traffic

detections/network/high_volume_of_bytes_out_to_url.yml

@@ -0,0 +1,56 @@
+name: High Volume of Bytes Out to Url
+id: c8a6b56d-16dd-4e9c-b4bd-527742ead98d
+version: 1
+date: '2024-02-22'
+author: Bhavin Patel, Splunk
+data_source: []
+type: Anomaly
+status: production
+description: The following analytic detects high volume of bytes out (greater than 1GB) to a URL within 2 mins of time window. This may be
+  indicative of an attacker attempting to exfiltrate data.  The search applies a fundamental threshold for detecting significant web uploads. This approach aims to identify potential data exfiltration activities by malware or malevolent insiders. View the alert for $dest$ to investigate further. 
+search: '| tstats  `security_content_summariesonly` count sum(Web.bytes_out) as sum_bytes_out values(Web.user) as user values(Web.app) as app values(Web.dest) as dest from datamodel=Web by _time span=2m Web.url Web.src sourcetype | search sum_bytes_out > 1070000000 | `drop_dm_object_name("Web")`| `high_volume_of_bytes_out_to_url_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on Web traffic that include fields relavent for traffic into the `Web` datamodel. Please adjust the threshold for the sum of bytes out as per your environment and user behavior. 
+known_false_positives: This search may trigger false positives if there is a legitimate reason for a high volume of bytes out to a URL. We recommend to investigate these findings. Consider updating the filter macro to exclude the applications that are relevant to your environment. 
+references:
+- https://attack.mitre.org/techniques/T1567/
+- https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html
+- https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/
+tags:
+  analytic_story:
+  - Data Exfiltration
+  asset_type: Endpoint
+  confidence: 30
+  impact: 30
+  message: A high volume of bytes out to a URL $url$ was detected from src $src$ to dest $dest$. 
+  mitre_attack_id:
+  - T1567
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Victim
+  - name: dest
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  risk_score: 9
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/web_upload_nginx/web_upload_nginx.log
+    source: /var/log/nginx/access.log
+    sourcetype: nginx:plus:kv

detections/web/connectwise_screenconnect_authentication_bypass.yml

@@ -1,19 +1,19 @@
 name: ConnectWise ScreenConnect Authentication Bypass
 id: d3f7a803-e802-448b-8eb2-e796b223bfff
-version: 1
-date: '2024-02-21'
+version: 2
+date: '2024-02-23'
 author: Michael Haag, Splunk
 data_source: []
 type: TTP
 status: production
 description: This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
-search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/SetupWizard.aspx/*","*/SetupWizard/") by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status, Web.http_method, sourcetype, source
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/SetupWizard.aspx/*","*/SetupWizard/") Web.status=200 Web.http_method=POST by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status, Web.http_method, sourcetype, source
   | rex field=Web.url "/SetupWizard.aspx/(?<randomPath>.+)"
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `connectwise_screenconnect_authentication_bypass_filter`'
-how_to_implement: To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
+how_to_implement: To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The analytic was written against Suricata. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
 known_false_positives: False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
 references:
 - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

detections/web/detect_remote_access_software_usage_url.yml

@@ -0,0 +1,64 @@
+name: Detect Remote Access Software Usage URL
+id: 9296f515-073c-43a5-88ec-eda5a4626654
+version: 1
+date: '2024-02-22'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+data_source: []
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime latest(Web.http_method) as http_method latest(Web.http_user_agent) as http_user_agent latest(Web.url) as url latest(Web.user) as user latest(Web.dest) as dest from datamodel=Web by Web.action Web.src Web.category Web.url_domain
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name("Web")`
+  | lookup remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference as desc, category
+  | search isutility = True
+  | `detect_remote_access_software_usage_url_filter`'
+how_to_implement: The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+tags:
+  analytic_story:
+  - Insider Threat
+  - Command And Control
+  - Ransomware
+  asset_type: Network
+  confidence: 50
+  impact: 50
+  message: A domain for a known remote access software $url_domain$ was contacted by $src$.
+  mitre_attack_id:
+  - T1219
+  observable:
+  - name: src
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: url_domain
+    type: Hostname
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.action
+  - Web.src
+  - Web.category 
+  - Web.url_domain  
+  risk_score: 25
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo.log
+    source: screenconnect_palo
+    sourcetype: pan:threat

detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml

@@ -0,0 +1,62 @@
+name: JetBrains TeamCity Authentication Bypass CVE-2024-27198
+id: fbcc04c7-8a79-453c-b3a9-c232c423bdd4
+version: 1
+date: '2024-03-04'
+author: Michael Haag, Splunk
+data_source: []
+type: TTP
+status: production
+description: 'The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution. Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.'
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where ((Web.url="*?jsp=*" AND Web.url="*;.jsp*") Web.status=200 Web.http_method=POST) OR (Web.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") Web.status=200 Web.http_method=POST ) by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status, Web.http_method, sourcetype, source
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`| `jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter`'
+how_to_implement: The detection relies on the Web datamodel and a CIM compliant log source, that may include Nginx, TeamCity logs, or other web server logs. 
+known_false_positives: False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
+references:
+- https://github.com/projectdiscovery/nuclei-templates/pull/9279/files
+- https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
+- https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
+- https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
+- https://github.com/yoryio/CVE-2024-27198/blob/main/CVE-2024-27198.py
+tags:
+  analytic_story:
+  - JetBrains TeamCity Vulnerabilities
+  asset_type: Web Server
+  confidence: 90
+  impact: 90
+  message: Possible JetBrains TeamCity Authentication Bypass CVE-2024-27198 Attempt against $dest$ from $src$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  - Web.url
+  - Web.status
+  - Web.http_method
+  - sourcetype
+  - source
+  risk_score: 81
+  security_domain: network
+  cve:
+  - CVE-2024-27198
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198.log
+    sourcetype: suricata
+    source: suricata

detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml

@@ -0,0 +1,60 @@
+name: JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198
+id: fbcc04c7-8a79-453c-b3a9-c232c423bdd3
+version: 1
+date: '2024-03-04'
+author: Michael Haag, Splunk
+data_source: []
+type: TTP
+status: production
+description: 'The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution.Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.'
+search: '`suricata`
+  ((http.url="*?jsp=*" AND http.url="*;.jsp*") http.status=200 http_method=POST) OR (http.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") http.status=200 http_method=POST ) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, http.http_user_agent, http.url, http.status,http_method
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`| `jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198_filter`'
+how_to_implement: The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
+known_false_positives: False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
+references:
+- https://github.com/projectdiscovery/nuclei-templates/pull/9279/files
+- https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
+- https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
+- https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
+tags:
+  analytic_story:
+  - JetBrains TeamCity Vulnerabilities
+  asset_type: Web Server
+  confidence: 90
+  impact: 90
+  message: Possible JetBrains TeamCity Authentication Bypass Attempt against $dest$ from $src$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - src
+  - dest
+  - http.http_user_agent
+  - http.url
+  - http.status
+  - http_method
+  risk_score: 81
+  security_domain: network
+  cve:
+  - CVE-2024-27198
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198.log
+    sourcetype: suricata
+    source: suricata

detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml

@@ -0,0 +1,60 @@
+name: JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199
+id: a1e68dcd-2e24-4434-bd0e-b3d4de139d58
+version: 1
+date: '2024-03-04'
+author: Michael Haag, Splunk
+data_source: []
+type: TTP
+status: production
+description: 'CVE-2024-27199 reveals a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated attackers to bypass authentication for a limited set of endpoints. This vulnerability exploits path traversal issues, enabling attackers to access and potentially modify system settings or disclose sensitive server information without proper authentication. Identified vulnerable paths include /res/, /update/, and /.well-known/acme-challenge/, among others. Attackers can manipulate these paths to reach restricted JSP pages and servlet endpoints, such as /app/https/settings/uploadCertificate, which could allow for the uploading of malicious HTTPS certificates or modification of server settings. This detection aims to identify potential exploitation attempts by monitoring for unusual access patterns to these endpoints, which could indicate an authentication bypass attempt in progress.'
+search: '`suricata` http.url IN ("*../admin/diagnostic.jsp*", "*../app/https/settings/*", "*../app/pipeline*", "*../app/oauth/space/createBuild.html*", "*../res/*", "*../update/*", "*../.well-known/acme-challenge/*", "*../app/availableRunners*", "*../app/https/settings/setPort*", "*../app/https/settings/certificateInfo*", "*../app/https/settings/defaultHttpsPort*", "*../app/https/settings/fetchFromAcme*", "*../app/https/settings/removeCertificate*", "*../app/https/settings/uploadCertificate*", "*../app/https/settings/termsOfService*", "*../app/https/settings/triggerAcmeChallenge*", "*../app/https/settings/cancelAcmeChallenge*", "*../app/https/settings/getAcmeOrder*", "*../app/https/settings/setRedirectStrategy*") http.status=200 http_method=GET 
+  | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, http_user_agent, http.url, http.status, http_method
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199_filter`'
+how_to_implement: The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
+known_false_positives: False positives are not expected, however, monitor, filter, and tune as needed based on organization log sources. The analytic is restricted to 200 and GET requests to specific URI paths, which should limit false positives.
+references:
+- https://github.com/projectdiscovery/nuclei-templates/blob/f644ec82dfe018890c6aa308967424d26c0f1522/http/cves/2024/CVE-2024-27199.yaml
+- https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
+- https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
+- https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
+tags:
+  analytic_story:
+  - JetBrains TeamCity Vulnerabilities
+  asset_type: Web Server
+  confidence: 70
+  impact: 90
+  message: Possible JetBrains TeamCity Limited Authentication Bypass Attempt against $dest$ from $src$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - src
+  - dest
+  - http_user_agent
+  - http.url
+  - http.status
+  - http_method
+  risk_score: 63
+  security_domain: network
+  cve:
+  - CVE-2024-27199
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27199.log
+    sourcetype: suricata
+    source: suricata
+

detections/web/jetbrains_teamcity_rce_attempt.yml

@@ -26,6 +26,7 @@ tags:
   analytic_story:
   - JetBrains TeamCity Unauthenticated RCE
   - CISA AA23-347A
+  - JetBrains TeamCity Vulnerabilities 
   asset_type: Web server
   atomic_guid: []
   confidence: 90

detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml

@@ -0,0 +1,61 @@
+name: Nginx ConnectWise ScreenConnect Authentication Bypass
+id: b3f7a803-e802-448b-8eb2-e796b223bccc
+version: 1
+date: '2024-02-23'
+author: Michael Haag, Splunk
+data_source: []
+type: TTP
+status: production
+description: This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
+search: '`nginx_access_logs` uri_path IN ("*/SetupWizard.aspx/*","*/SetupWizard/") status=200 http_method=POST  | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, http_user_agent, url, uri_path, status, http_method, sourcetype, source
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `nginx_connectwise_screenconnect_authentication_bypass_filter`'
+how_to_implement: To implement this analytic, ensure proper logging is occurring with Nginx, access.log and error.log, and that these logs are being ingested into Splunk. STRT utilizes this nginx.conf https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec to properly log as much data with Nginx. 
+known_false_positives: False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
+references:
+- https://docs.splunk.com/Documentation/AddOns/released/NGINX/Sourcetypes
+- https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec
+- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
+- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
+- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
+tags:
+  analytic_story:
+  - ConnectWise ScreenConnect Vulnerabilities
+  asset_type: Web
+  confidence: 100
+  impact: 100
+  message: An authentication bypass attempt against ScreenConnect has been detected on $dest$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - src
+  - dest
+  - http_user_agent
+  - url
+  - uri_path
+  - status
+  - http_method
+  - sourcetype
+  - source
+  risk_score: 100
+  security_domain: network
+  cve:
+  - CVE-2024-1708
+  - CVE-2024-1709 
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/nginx_screenconnect.log
+    sourcetype: nginx:plus:kv
+    source: nginx:plus:kv

dist/DA-ESS-ContentUpdate/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "4.25.0"
+      "version": "4.26.0"
     }, 
     "author": [
       {

dist/DA-ESS-ContentUpdate/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -997,7 +997,7 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event.
 providing_technologies = ["Amazon Security Lake"]
 
-[savedsearch://ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule]
+[savedsearch://ESCU - AWS AMI Attribute Modification for Exfiltration - Rule]
 type = detection
 asset_type = EC2 Snapshot
 confidence = medium
@@ -1402,7 +1402,7 @@ providing_technologies = ["Amazon Web Services - Cloudtrail"]
 type = detection
 asset_type = AWS Account
 confidence = medium
-explanation = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
+explanation = The following detection identifies when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
 how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1098"], "nist": ["DE.AE"]}
 known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
@@ -2185,6 +2185,19 @@ known_false_positives = This is a strictly behavioral search, so we define "fals
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = null
 
+[savedsearch://ESCU - Cloud Security Groups Modifications by User - Rule]
+type = detection
+asset_type = Cloud Instance
+confidence = medium
+explanation = The following analytic identifies users who are unsually modifying security group in your cloud enriovnment,focusing on actions such as modifications, deletions, or creations performed by users over 30-minute intervals. Analyzing patterns of modifications to security groups can help in identifying anomalous behavior that may indicate a compromised account or an insider threat.\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+This detection will only trigger on all user and service accounts that have created/modified/deleted a security group .\
+The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and values of the security objects affected.
+how_to_implement = This search requries the Cloud infrastructure logs such as AWS Cloudtrail, GCP Pubsub Message logs, Azure Audit logs to be ingested into an accelerated Change datamodel. It is also recommended that users can try different combinations of the `bucket` span time and outlier conditions to better suit with their environment.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1578.005"], "nist": ["DE.AE"]}
+known_false_positives = It is possible that legitimate user/admin may modify a number of security groups
+providing_technologies = null
+
 [savedsearch://ESCU - Detect AWS Console Login by New User - Rule]
 type = detection
 asset_type = AWS Instance
@@ -5322,6 +5335,36 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = Limited false positives related to third party software registering .DLL's.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Detect Remote Access Software Usage File - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic detects when a file from a known remote access software is written to disk within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+known_false_positives = Known or approved applications used by the organization or usage of built-in functions.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Detect Remote Access Software Usage FileInfo - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic detects when process with file or code signing attributes from a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+how_to_implement = This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+known_false_positives = Known or approved applications used by the organization or usage of built-in functions.
+providing_technologies = ["Microsoft Sysmon"]
+
+[savedsearch://ESCU - Detect Remote Access Software Usage Process - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic detects when a known remote access software is executed within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Detect Renamed 7-Zip - Rule]
 type = detection
 asset_type = Endpoint
@@ -13166,6 +13209,36 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"]
 known_false_positives = third party application may use this proxies if allowed in production environment. Filter is needed.
 providing_technologies = ["Microsoft Sysmon"]
 
+[savedsearch://ESCU - Windows Multiple Account Passwords Changed - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This Splunk detection identifies situations where over five unique Windows account passwords are changed within a 10-minute interval, captured by Event Code 4724 in the Windows Security Event Log. The query utilizes the wineventlog_security dataset, organizing data into 10-minute periods to monitor the count and distinct count of TargetUserName, the accounts with altered passwords. Rapid password changes across multiple accounts are atypical and might indicate unauthorized access or an internal actor compromising account security. Teams should calibrate the detection's threshold and timeframe to fit their specific operational context.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+known_false_positives = Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows Multiple Accounts Deleted - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic flags when more than five unique Windows accounts are deleted within a 10-minute period, identified by Event Code 4726 in the Windows Security Event Log. Using the wineventlog_security dataset, it segments data into 10-minute intervals to monitor account deletions, a pattern that could suggest malicious intent like an attacker erasing traces. Teams should adjust the detection's threshold and timeframe to suit their specific environment.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+known_false_positives = Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows Multiple Accounts Disabled - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This Splunk detection focuses on instances where more than five unique Windows accounts are disabled within a 10-minute window, as indicated by Event Code 4725 in the Windows Security Event Log. The query analyzes the wineventlog_security dataset, grouping data into 10-minute segments, and tracks the count and distinct count of TargetUserName, the accounts being disabled. This pattern of disabling multiple accounts rapidly is unusual and could signal internal policy breaches or an external attacker's attempt to disrupt normal operations. Teams are advised to tailor the threshold and timeframe of this detection to their environment's specifics
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+known_false_positives = Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos - Rule]
 type = detection
 asset_type = Endpoint
@@ -15233,6 +15306,26 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery", "Actions o
 known_false_positives = This search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.
 providing_technologies = null
 
+[savedsearch://ESCU - Detect Remote Access Software Usage DNS - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic detects when a known remote access software domains are contacted from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+how_to_implement = To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+providing_technologies = null
+
+[savedsearch://ESCU - Detect Remote Access Software Usage Traffic - Rule]
+type = detection
+asset_type = Network
+confidence = medium
+explanation = The following analytic detects when a known remote access software application traffic is detected from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+how_to_implement = The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+providing_technologies = null
+
 [savedsearch://ESCU - Detect Rogue DHCP Server - Rule]
 type = detection
 asset_type = Infrastructure
@@ -15378,6 +15471,16 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery", "Installat
 known_false_positives = False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
 providing_technologies = null
 
+[savedsearch://ESCU - High Volume of Bytes Out to Url - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic detects high volume of bytes out (greater than 1GB) to a URL within 2 mins of time window. This may be indicative of an attacker attempting to exfiltrate data.  The search applies a fundamental threshold for detecting significant web uploads. This approach aims to identify potential data exfiltration activities by malware or malevolent insiders. View the alert for $dest$ to investigate further.
+how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. Please adjust the threshold for the sum of bytes out as per your environment and user behavior.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1567"], "nist": ["DE.AE"]}
+known_false_positives = This search may trigger false positives if there is a legitimate reason for a high volume of bytes out to a URL. We recommend to investigate these findings. Consider updating the filter macro to exclude the applications that are relevant to your environment.
+providing_technologies = null
+
 [savedsearch://ESCU - Hosts receiving high volume of network traffic from email server - Rule]
 type = detection
 asset_type = Endpoint
@@ -15697,7 +15800,7 @@ type = detection
 asset_type = Web
 confidence = medium
 explanation = This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
-how_to_implement = To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
+how_to_implement = To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The analytic was written against Suricata. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
 providing_technologies = null
@@ -15732,6 +15835,16 @@ annotations = {"cis20": ["CIS 13"], "nist": ["DE.CM"]}
 known_false_positives = No known false positives for this detection.
 providing_technologies = null
 
+[savedsearch://ESCU - Detect Remote Access Software Usage URL - Rule]
+type = detection
+asset_type = Network
+confidence = medium
+explanation = The following analytic detects when a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+how_to_implement = The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+providing_technologies = null
+
 [savedsearch://ESCU - Exploit Public Facing Application via Apache Commons Text - Rule]
 type = detection
 asset_type = Web Server
@@ -15866,6 +15979,36 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = False positives should be limited as this detection is based on a specific URL path and HTTP status code. Adjust the search as necessary to fit the environment.
 providing_technologies = null
 
+[savedsearch://ESCU - JetBrains TeamCity Authentication Bypass CVE-2024-27198 - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution. Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+how_to_implement = The detection relies on the Web datamodel and a CIM compliant log source, that may include Nginx, TeamCity logs, or other web server logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
+providing_technologies = null
+
+[savedsearch://ESCU - JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution.Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+how_to_implement = The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
+providing_technologies = null
+
+[savedsearch://ESCU - JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = CVE-2024-27199 reveals a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated attackers to bypass authentication for a limited set of endpoints. This vulnerability exploits path traversal issues, enabling attackers to access and potentially modify system settings or disclose sensitive server information without proper authentication. Identified vulnerable paths include /res/, /update/, and /.well-known/acme-challenge/, among others. Attackers can manipulate these paths to reach restricted JSP pages and servlet endpoints, such as /app/https/settings/uploadCertificate, which could allow for the uploading of malicious HTTPS certificates or modification of server settings. This detection aims to identify potential exploitation attempts by monitoring for unusual access patterns to these endpoints, which could indicate an authentication bypass attempt in progress.
+how_to_implement = The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives are not expected, however, monitor, filter, and tune as needed based on organization log sources. The analytic is restricted to 200 and GET requests to specific URI paths, which should limit false positives.
+providing_technologies = null
+
 [savedsearch://ESCU - JetBrains TeamCity RCE Attempt - Rule]
 type = detection
 asset_type = Web server
@@ -15926,6 +16069,16 @@ annotations = {"cis20": ["CIS 13"], "nist": ["DE.CM"]}
 known_false_positives = None at this time
 providing_technologies = null
 
+[savedsearch://ESCU - Nginx ConnectWise ScreenConnect Authentication Bypass - Rule]
+type = detection
+asset_type = Web
+confidence = medium
+explanation = This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
+how_to_implement = To implement this analytic, ensure proper logging is occurring with Nginx, access.log and error.log, and that these logs are being ingested into Splunk. STRT utilizes this nginx.conf https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec to properly log as much data with Nginx.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
+providing_technologies = null
+
 [savedsearch://ESCU - PaperCut NG Remote Web Access Attempt - Rule]
 type = detection
 asset_type = Web Server
@@ -16405,7 +16558,7 @@ version = 1
 references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://attack.mitre.org/tactics/TA0003/", "https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
-searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD FullAccessAsApp Permission Assigned - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD Multiple Service Principals Created by SP - Rule", "ESCU - Azure AD Multiple Service Principals Created by User - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD New MFA Method Registered - Rule", "ESCU - Azure AD PIM Role Assigned - Rule", "ESCU - Azure AD PIM Role Assignment Activated - Rule", "ESCU - Azure AD Privileged Graph API Permission Assigned - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD Tenant Wide Admin Consent Granted - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"]
+searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD FullAccessAsApp Permission Assigned - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD Multiple Service Principals Created by SP - Rule", "ESCU - Azure AD Multiple Service Principals Created by User - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD New MFA Method Registered - Rule", "ESCU - Azure AD PIM Role Assigned - Rule", "ESCU - Azure AD PIM Role Assignment Activated - Rule", "ESCU - Azure AD Privileged Graph API Permission Assigned - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD Tenant Wide Admin Consent Granted - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule", "ESCU - Windows Multiple Account Passwords Changed - Rule", "ESCU - Windows Multiple Accounts Deleted - Rule", "ESCU - Windows Multiple Accounts Disabled - Rule"]
 description = Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.
 narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants. 
 
@@ -16696,7 +16849,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
+searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Remote Access Software Usage File - Rule", "ESCU - Detect Remote Access Software Usage FileInfo - Rule", "ESCU - Detect Remote Access Software Usage Process - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Remote Access Software Usage DNS - Rule", "ESCU - Detect Remote Access Software Usage Traffic - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Remote Access Software Usage URL - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate Command And Control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
 Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists.
@@ -16730,7 +16883,7 @@ version = 1
 references = ["https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass", "https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2", "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - ConnectWise ScreenConnect Path Traversal - Rule", "ESCU - ConnectWise ScreenConnect Path Traversal Windows SACL - Rule", "ESCU - ConnectWise ScreenConnect Authentication Bypass - Rule"]
+searches = ["ESCU - ConnectWise ScreenConnect Path Traversal - Rule", "ESCU - ConnectWise ScreenConnect Path Traversal Windows SACL - Rule", "ESCU - ConnectWise ScreenConnect Authentication Bypass - Rule", "ESCU - Nginx ConnectWise ScreenConnect Authentication Bypass - Rule"]
 description = This analytic story provides a comprehensive overview of the ConnectWise ScreenConnect vulnerabilities.
 narrative = The following analytic story includes content for recently disclosed CWE-288 Authentication Bypass and CWE-22 Path Traversal. The vulnerabilities, identified as critical with CVSS scores of 10 and 9.8, respectively, enable unauthorized users to bypass authentication and perform path traversal attacks on affected ScreenConnect instances. The analytic story includes detection analytics for both vulnerabilities, which are crucial for identifying and responding to active exploitation in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issues, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers. The analytic story also includes guidance on how to implement the detection analytics, known false positives, and references to additional resources for further analysis and remediation.
 
@@ -16864,7 +17017,7 @@ version = 2
 references = ["https://attack.mitre.org/tactics/TA0010/", "https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436", "https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a"]
 maintainers = [{"company": "Shannon Davis, Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule", "ESCU - AWS Disable Bucket Versioning - Rule", "ESCU - AWS EC2 Snapshot Shared Externally - Rule", "ESCU - AWS Exfiltration via Anomalous GetObject API Activity - Rule", "ESCU - AWS Exfiltration via Batch Service - Rule", "ESCU - AWS Exfiltration via Bucket Replication - Rule", "ESCU - AWS Exfiltration via DataSync Task - Rule", "ESCU - AWS Exfiltration via EC2 Snapshot - Rule", "ESCU - AWS S3 Exfiltration Behavior Identified - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Detect Certipy File Modifications - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - AWS AMI Attribute Modification for Exfiltration - Rule", "ESCU - AWS Disable Bucket Versioning - Rule", "ESCU - AWS EC2 Snapshot Shared Externally - Rule", "ESCU - AWS Exfiltration via Anomalous GetObject API Activity - Rule", "ESCU - AWS Exfiltration via Batch Service - Rule", "ESCU - AWS Exfiltration via Bucket Replication - Rule", "ESCU - AWS Exfiltration via DataSync Task - Rule", "ESCU - AWS Exfiltration via EC2 Snapshot - Rule", "ESCU - AWS S3 Exfiltration Behavior Identified - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Detect Certipy File Modifications - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - High Volume of Bytes Out to Url - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
 description = Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets.
 narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command And Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.\
 Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. In context of the cloud, this refers to the unauthorized transfer or extraction of sensitive data from cloud-based systems or services. It involves the compromise of cloud infrastructure or accounts to gain access to valuable information stored in the cloud environment. Attackers may employ various techniques, such as exploiting vulnerabilities, stealing login credentials, or using malicious code to exfiltrate data from cloud repositories or services without detection.
@@ -17397,7 +17550,7 @@ version = 1
 references = ["https://www.imperva.com/learn/application-security/insider-threats/", "https://www.cisa.gov/defining-insider-threats", "https://www.code42.com/glossary/types-of-insider-threats/", "https://github.com/Insider-Threat/Insider-Threat", "https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}]
 spec_version = 3
-searches = ["ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - High Frequency Copy Of Files In Network Share - Rule", "ESCU - Potential password in username - Rule", "ESCU - Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials - Rule", "ESCU - Windows Multiple Users Failed To Authenticate From Process - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials - Rule", "ESCU - Windows Unusual Count Of Users Failed To Authenticate From Process - Rule"]
+searches = ["ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - Detect Remote Access Software Usage File - Rule", "ESCU - Detect Remote Access Software Usage FileInfo - Rule", "ESCU - Detect Remote Access Software Usage Process - Rule", "ESCU - High Frequency Copy Of Files In Network Share - Rule", "ESCU - Potential password in username - Rule", "ESCU - Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials - Rule", "ESCU - Windows Multiple Users Failed To Authenticate From Process - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials - Rule", "ESCU - Windows Unusual Count Of Users Failed To Authenticate From Process - Rule", "ESCU - Detect Remote Access Software Usage DNS - Rule", "ESCU - Detect Remote Access Software Usage Traffic - Rule", "ESCU - Detect Remote Access Software Usage URL - Rule"]
 description = Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.
 narrative = Insider Threats are best defined by CISA: "Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs." An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats: Departing Employees, Security Evaders, Malicious Insiders, and Negligent Employees. This story aims at detecting the malicious insider.
 
@@ -17485,6 +17638,17 @@ searches = ["ESCU - JetBrains TeamCity RCE Attempt - Rule"]
 description = A critical security vulnerability, CVE-2023-42793, has been discovered affecting all versions of TeamCity On-Premises up to 2023.05.3. This vulnerability allows unauthenticated attackers to execute remote code and gain administrative control of the TeamCity server, posing a significant risk for supply chain attacks. Although the issue has been fixed in version 2023.05.4, servers running older versions remain at risk. A security patch plugin has been released for immediate mitigation, applicable to TeamCity versions 8.0 and above. Organizations are strongly advised to update to the fixed version or apply the security patch, especially if their TeamCity server is publicly accessible. No impact has been reported on TeamCity Cloud as it has been upgraded to the secure version.
 narrative = The CVE-2023-42793 vulnerability in TeamCity On-Premises allows an unauthenticated attacker to bypass authentication and gain administrative access through Remote Code Execution (RCE). Specifically, the attacker can send a malicious POST request to /app/rest/users/id:1/tokens/RPC2 to create an administrative token. Once the token is obtained, the attacker has the ability to perform various unauthorized activities, including creating new admin users and executing arbitrary shell commands on the server. \ For Splunk Security Content, the focus should be on identifying suspicious POST requests to /app/rest/users/id:1/tokens/RPC2 and other affected API endpoints, as this is the initial point of exploitation. Monitoring logs for changes to the internal.properties file or the creation of new admin users could also provide crucial indicators of compromise. Furthermore, Splunk can be configured to alert on multiple failed login attempts followed by a successful login from the same IP, which could indicate exploitation attempts.
 
+[analytic_story://JetBrains TeamCity Vulnerabilities]
+category = Adversary Tactics
+last_updated = 2024-03-04
+version = 1
+references = ["https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/", "https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/", "https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - JetBrains TeamCity Authentication Bypass CVE-2024-27198 - Rule", "ESCU - JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 - Rule", "ESCU - JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 - Rule", "ESCU - JetBrains TeamCity RCE Attempt - Rule"]
+description = This story provides a high-level overview of JetBrains TeamCity vulnerabilities and how to detect and respond to them using Splunk.
+narrative = JetBrains TeamCity is a continuous integration and deployment server that allows developers to automate the process of building, testing, and deploying code. It is a popular tool used by many organizations to streamline their development and deployment processes. However, like any software, JetBrains TeamCity is not immune to vulnerabilities.
+
 [analytic_story://Juniper JunOS Remote Code Execution]
 category = Adversary Tactics
 last_updated = 2023-08-29
@@ -18011,7 +18175,7 @@ version = 1
 references = ["https://web.archive.org/web/20190826231258/https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
+searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Remote Access Software Usage File - Rule", "ESCU - Detect Remote Access Software Usage FileInfo - Rule", "ESCU - Detect Remote Access Software Usage Process - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Detect Remote Access Software Usage DNS - Rule", "ESCU - Detect Remote Access Software Usage Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Remote Access Software Usage URL - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
 
@@ -18242,6 +18406,17 @@ searches = ["ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicio
 description = Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.
 narrative = Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party Caffiliates or pay-per-install (PPI) partners, typically seen as commodity adware/malware. Additional indicators and behaviors may be found within the references.
 
+[analytic_story://Snake Keylogger]
+category = Adversary Tactics
+last_updated = 2024-02-12
+version = 1
+references = ["https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger", "https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/snake-keylogger-malware/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process DNS Query Known Abuse Web Services - Rule", "ESCU - Suspicious Process Executed From Container File - Rule", "ESCU - Windows Credentials from Password Stores Chrome LocalState Access - Rule", "ESCU - Windows Credentials from Password Stores Chrome Login Data Access - Rule", "ESCU - Windows File Transfer Protocol In Non-Common Process Path - Rule", "ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule", "ESCU - Windows Non Discord App Access Discord LevelDB - Rule", "ESCU - Windows Phishing PDF File Executes URL Link - Rule", "ESCU - Windows System Network Connections Discovery Netsh - Rule", "ESCU - Windows Time Based Evasion via Choice Exec - Rule", "ESCU - Windows Unsecured Outlook Credentials Access In Registry - Rule", "ESCU - Windows User Execution Malicious URL Shortcut File - Rule"]
+description = SnakeKeylogger is a stealthy malware designed to secretly record keystrokes on infected devices. It operates covertly in the background, capturing sensitive information such as passwords and credit card details. This keylogging threat poses a significant risk to user privacy and security.
+narrative = SnakeKeylogger, a notorious malware, first emerged in the early 2010s, gaining infamy for its clandestine ability to capture keystrokes on compromised systems. As a stealthy threat, it infiltrates computers silently, recording every keystroke entered by users, including sensitive information like passwords and financial details. Over time, it has evolved to evade detection mechanisms, posing a persistent threat to cybersecurity. Its widespread use in various cybercrime activities underscores its significance as a tool for espionage and data theft. Despite efforts to combat it, SnakeKeylogger continues to lurk in the shadows, perpetuating its malicious activities with devastating consequences.
+
 [analytic_story://Snake Malware]
 category = Adversary Tactics
 last_updated = 2023-05-10
@@ -18403,7 +18578,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule", "ESCU - AWS EC2 Snapshot Shared Externally - Rule", "ESCU - AWS Exfiltration via EC2 Snapshot - Rule", "ESCU - AWS S3 Exfiltration Behavior Identified - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - AWS AMI Attribute Modification for Exfiltration - Rule", "ESCU - AWS EC2 Snapshot Shared Externally - Rule", "ESCU - AWS Exfiltration via EC2 Snapshot - Rule", "ESCU - AWS S3 Exfiltration Behavior Identified - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
 
@@ -18426,7 +18601,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Lambda UpdateFunctionCode - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Lambda UpdateFunctionCode - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - Cloud Security Groups Modifications by User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
 narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.

dist/DA-ESS-ContentUpdate/default/app.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -10,7 +10,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 20240222185319
+build = 20240306221540
 
 [triggers]
 reload.analytic_stories = simple
@@ -26,7 +26,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.25.0 
+version = 4.26.0 
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/DA-ESS-ContentUpdate/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/content-version.conf

@@ -1,8 +1,8 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
 [content-version]
-version = 4.25.0 
+version = 4.26.0 

dist/DA-ESS-ContentUpdate/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -393,7 +393,7 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[aws_ami_atttribute_modification_for_exfiltration_filter]
+[aws_ami_attribute_modification_for_exfiltration_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
@@ -865,6 +865,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[cloud_security_groups_modifications_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_aws_console_login_by_new_user_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2053,6 +2057,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_remote_access_software_usage_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_remote_access_software_usage_fileinfo_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_remote_access_software_usage_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_renamed_7_zip_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5133,6 +5149,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_multiple_account_passwords_changed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_multiple_accounts_deleted_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_multiple_accounts_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5925,6 +5953,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_remote_access_software_usage_dns_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_remote_access_software_usage_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_rogue_dhcp_server_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5977,6 +6013,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[high_volume_of_bytes_out_to_url_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -6113,6 +6153,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_remote_access_software_usage_url_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [exploit_public_facing_application_via_apache_commons_text_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -6161,6 +6205,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [jetbrains_teamcity_rce_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -6185,6 +6241,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[nginx_connectwise_screenconnect_authentication_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [papercut_ng_remote_web_access_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -6543,6 +6603,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
 description = This is a list of AWS event names that are associated with Network ACLs
 
+[nginx_access_logs]
+definition = (sourcetype="nginx:plus:kv" OR sourcetype="nginx:plus:access")
+description = This is the base macro for Nginx sourcetypes
+
 [o365_graph]
 definition = sourcetype=o365:graph:api
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -6920,6 +6984,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = sourcetype="PwSh:SubjectInterfacePackage"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[suricata]
+definition = sourcetype=suricata
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [suspicious_email_attachments]
 definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
 description = This macro limits the output to email attachments that have suspicious extensions

dist/DA-ESS-ContentUpdate/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -3904,7 +3904,7 @@ realtime_schedule = 0
 is_visible = false
 search = `amazon_security_lake` "api.service.name"="iam.amazonaws.com" "api.operation" IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") "api.response.error"=null | stats count min(_time) as firstTime max(_time) as lastTime by identity.user.account_uid identity.user.credential_uid identity.user.name identity.user.type identity.user.uid identity.user.uuid http_request.user_agent src_endpoint.ip cloud.region | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_password_policy_changes_filter`
 
-[ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule]
+[ESCU - AWS AMI Attribute Modification for Exfiltration - Rule]
 action.escu = 0
 action.escu.enabled = 1
 description = This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs.
@@ -3916,7 +3916,7 @@ action.escu.known_false_positives = It is possible that an AWS admin has legitim
 action.escu.creation_date = 2023-03-31
 action.escu.modification_date = 2023-03-31
 action.escu.confidence = high
-action.escu.full_search_name = ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule
+action.escu.full_search_name = ESCU - AWS AMI Attribute Modification for Exfiltration - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
@@ -3930,13 +3930,13 @@ cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule
+action.correlationsearch.label = ESCU - AWS AMI Attribute Modification for Exfiltration - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 10"], "confidence": 80, "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
 action.notable.param.rule_description = This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs.
-action.notable.param.rule_title = AWS AMI Atttribute Modification for Exfiltration
+action.notable.param.rule_title = AWS AMI Attribute Modification for Exfiltration
 action.notable.param.security_domain = threat
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -3948,7 +3948,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all) |  rename requestParameters.launchPermission.add.items{}.group as group_added |  rename requestParameters.launchPermission.add.items{}.userId as accounts_added | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")  | stats count min(_time) as firstTime max(_time) as lastTime  values(group_added) values(accounts_added) as accounts_added values(ami_status) by  src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId |  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_atttribute_modification_for_exfiltration_filter`
+search = `cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all) |  rename requestParameters.launchPermission.add.items{}.group as group_added |  rename requestParameters.launchPermission.add.items{}.userId as accounts_added | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")  | stats count min(_time) as firstTime max(_time) as lastTime  values(group_added) values(accounts_added) as accounts_added values(ami_status) by  src_ip region eventName userAgent user_arn aws_account_id userIdentity.principalId |  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_ami_attribute_modification_for_exfiltration_filter`
 
 [ESCU - AWS Concurrent Sessions From Different Ips - Rule]
 action.escu = 0
@@ -5590,10 +5590,10 @@ search = `cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failur
 [ESCU - AWS IAM Delete Policy - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
+description = The following detection identifies when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
 action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1098"], "nist": ["DE.AE"]}
 action.escu.data_models = []
-action.escu.eli5 = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
+action.escu.eli5 = The following detection identifies when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
 action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
 action.escu.known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
 action.escu.creation_date = 2021-04-01
@@ -8981,6 +8981,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter` | `security_content_ctime(firstTime)`
 
+[ESCU - Cloud Security Groups Modifications by User - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies users who are unsually modifying security group in your cloud enriovnment,focusing on actions such as modifications, deletions, or creations performed by users over 30-minute intervals. Analyzing patterns of modifications to security groups can help in identifying anomalous behavior that may indicate a compromised account or an insider threat.\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+This detection will only trigger on all user and service accounts that have created/modified/deleted a security group .\
+The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and values of the security objects affected.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1578.005"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Change"]
+action.escu.eli5 = The following analytic identifies users who are unsually modifying security group in your cloud enriovnment,focusing on actions such as modifications, deletions, or creations performed by users over 30-minute intervals. Analyzing patterns of modifications to security groups can help in identifying anomalous behavior that may indicate a compromised account or an insider threat.\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+This detection will only trigger on all user and service accounts that have created/modified/deleted a security group .\
+The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and values of the security objects affected.
+action.escu.how_to_implement = This search requries the Cloud infrastructure logs such as AWS Cloudtrail, GCP Pubsub Message logs, Azure Audit logs to be ingested into an accelerated Change datamodel. It is also recommended that users can try different combinations of the `bucket` span time and outlier conditions to better suit with their environment.
+action.escu.known_false_positives = It is possible that legitimate user/admin may modify a number of security groups
+action.escu.creation_date = 2024-02-21
+action.escu.modification_date = 2024-02-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Cloud Security Groups Modifications by User - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Cloud User Activities"]
+action.risk = 1
+action.risk.param._risk_message = Unsual number cloud security group modifications detected by user - $user$
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Cloud Security Groups Modifications by User - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1578.005"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats dc(All_Changes.object) as unique_security_groups values(All_Changes.src) as src values(All_Changes.user_type) as user_type values(All_Changes.object_category) as object_category values(All_Changes.object) as objects values(All_Changes.action) as action  values(All_Changes.user_agent) as user_agent values(All_Changes.command) as command from datamodel=Change WHERE All_Changes.object_category = "security_group" (All_Changes.action = modified OR All_Changes.action = deleted OR All_Changes.action = created)  by All_Changes.user  _time span=30m |  `drop_dm_object_name("All_Changes")` | eventstats avg(unique_security_groups) as avg_changes , stdev(unique_security_groups) as std_changes by user | eval upperBound=(avg_changes+std_changes*3) | eval isOutlier=if(unique_security_groups > 2 and unique_security_groups >= upperBound, 1, 0) | where isOutlier=1| `cloud_security_groups_modifications_by_user_filter`
+
 [ESCU - Detect AWS Console Login by New User - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -13004,7 +13050,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search =  `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon |  bucket span=5m _time |  stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent by _time, src_ip |  where unique_accounts > 10 | `o365_multiple_users_failing_to_authenticate_from_ip_filter`
+search =  `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126 |  bucket span=5m _time |  stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent by _time, src_ip |  where unique_accounts > 10 | `o365_multiple_users_failing_to_authenticate_from_ip_filter`
 
 [ESCU - O365 New Federated Domain Added - Rule]
 action.escu = 0
@@ -21723,6 +21769,126 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`
 
+[ESCU - Detect Remote Access Software Usage File - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic detects when a file from a known remote access software is written to disk within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic detects when a file from a known remote access software is written to disk within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+action.escu.known_false_positives = Known or approved applications used by the organization or usage of built-in functions.
+action.escu.creation_date = 2024-02-22
+action.escu.modification_date = 2024-02-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Remote Access Software Usage File - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Insider Threat", "Command And Control", "Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "file_name", "threat_object_type": "file_name"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Remote Access Software Usage File - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Insider Threat", "Command And Control", "Ransomware"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count, min(_time) as firstTime, max(_time) as lastTime, values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.dest, Filesystem.user, Filesystem.file_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Filesystem)` | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `detect_remote_access_software_usage_file_filter`
+
+[ESCU - Detect Remote Access Software Usage FileInfo - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic detects when process with file or code signing attributes from a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic detects when process with file or code signing attributes from a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.how_to_implement = This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk.
+action.escu.known_false_positives = Known or approved applications used by the organization or usage of built-in functions.
+action.escu.creation_date = 2024-02-22
+action.escu.modification_date = 2024-02-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Remote Access Software Usage FileInfo - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Sysmon"]
+action.escu.analytic_story = ["Insider Threat", "Command And Control", "Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = A file attributes for known a remote access software [$process_name$] was detected on $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Remote Access Software Usage FileInfo - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Insider Threat", "Command And Control", "Ransomware"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=1 | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product by dest, user, parent_process_name, process_name, process | lookup remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `detect_remote_access_software_usage_fileinfo_filter`
+
+[ESCU - Detect Remote Access Software Usage Process - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic detects when a known remote access software is executed within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic detects when a known remote access software is executed within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.how_to_implement = The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+action.escu.known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+action.escu.creation_date = 2024-02-22
+action.escu.modification_date = 2024-02-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Remote Access Software Usage Process - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Insider Threat", "Command And Control", "Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = A process for a known remote access software $process_name$ was identified on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Remote Access Software Usage Process - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Insider Threat", "Command And Control", "Ransomware"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.process!=unknown by Processes.dest Processes.user Processes.process_name Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup remote_access_software remote_utility AS process_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `detect_remote_access_software_usage_process_filter`
+
 [ESCU - Detect Renamed 7-Zip - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -55175,6 +55341,144 @@ realtime_schedule = 0
 is_visible = false
 search = `sysmon` EventCode=22 QueryName IN ("*.torproject.org", "www.theonionrouter.com") | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multi_hop_proxy_tor_website_query_filter`
 
+[ESCU - Windows Multiple Account Passwords Changed - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This Splunk detection identifies situations where over five unique Windows account passwords are changed within a 10-minute interval, captured by Event Code 4724 in the Windows Security Event Log. The query utilizes the wineventlog_security dataset, organizing data into 10-minute periods to monitor the count and distinct count of TargetUserName, the accounts with altered passwords. Rapid password changes across multiple accounts are atypical and might indicate unauthorized access or an internal actor compromising account security. Teams should calibrate the detection's threshold and timeframe to fit their specific operational context.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This Splunk detection identifies situations where over five unique Windows account passwords are changed within a 10-minute interval, captured by Event Code 4724 in the Windows Security Event Log. The query utilizes the wineventlog_security dataset, organizing data into 10-minute periods to monitor the count and distinct count of TargetUserName, the accounts with altered passwords. Rapid password changes across multiple accounts are atypical and might indicate unauthorized access or an internal actor compromising account security. Teams should calibrate the detection's threshold and timeframe to fit their specific operational context.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
+action.escu.known_false_positives = Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+action.escu.creation_date = 2024-02-20
+action.escu.modification_date = 2024-02-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Multiple Account Passwords Changed - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = User $src_user$ changed the passwords of multiple accounts in a short period of time.
+action.risk.param._risk = [{"risk_object_field": "src_user", "risk_object_type": "other", "risk_score": 24}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Multiple Account Passwords Changed - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 10"], "confidence": 60, "impact": 40, "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = This Splunk detection identifies situations where over five unique Windows account passwords are changed within a 10-minute interval, captured by Event Code 4724 in the Windows Security Event Log. The query utilizes the wineventlog_security dataset, organizing data into 10-minute periods to monitor the count and distinct count of TargetUserName, the accounts with altered passwords. Rapid password changes across multiple accounts are atypical and might indicate unauthorized access or an internal actor compromising account security. Teams should calibrate the detection's threshold and timeframe to fit their specific operational context.
+action.notable.param.rule_title = Windows Multiple Account Passwords Changed
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=4724 status=success | bucket span=10m _time | stats count dc(user) as unique_users values(user) as user by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users > 5 | `windows_multiple_account_passwords_changed_filter`
+
+[ESCU - Windows Multiple Accounts Deleted - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic flags when more than five unique Windows accounts are deleted within a 10-minute period, identified by Event Code 4726 in the Windows Security Event Log. Using the wineventlog_security dataset, it segments data into 10-minute intervals to monitor account deletions, a pattern that could suggest malicious intent like an attacker erasing traces. Teams should adjust the detection's threshold and timeframe to suit their specific environment.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic flags when more than five unique Windows accounts are deleted within a 10-minute period, identified by Event Code 4726 in the Windows Security Event Log. Using the wineventlog_security dataset, it segments data into 10-minute intervals to monitor account deletions, a pattern that could suggest malicious intent like an attacker erasing traces. Teams should adjust the detection's threshold and timeframe to suit their specific environment.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
+action.escu.known_false_positives = Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+action.escu.creation_date = 2024-02-21
+action.escu.modification_date = 2024-02-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Multiple Accounts Deleted - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = User $src_user$ deleted multiple accounts in a short period of time.
+action.risk.param._risk = [{"risk_object_field": "src_user", "risk_object_type": "other", "risk_score": 18}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Multiple Accounts Deleted - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 10"], "confidence": 60, "impact": 30, "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic flags when more than five unique Windows accounts are deleted within a 10-minute period, identified by Event Code 4726 in the Windows Security Event Log. Using the wineventlog_security dataset, it segments data into 10-minute intervals to monitor account deletions, a pattern that could suggest malicious intent like an attacker erasing traces. Teams should adjust the detection's threshold and timeframe to suit their specific environment.
+action.notable.param.rule_title = Windows Multiple Accounts Deleted
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=4726 status=success | bucket span=10m _time | stats count dc(user) as unique_users values(user) as user by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users > 5 | `windows_multiple_accounts_deleted_filter`
+
+[ESCU - Windows Multiple Accounts Disabled - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This Splunk detection focuses on instances where more than five unique Windows accounts are disabled within a 10-minute window, as indicated by Event Code 4725 in the Windows Security Event Log. The query analyzes the wineventlog_security dataset, grouping data into 10-minute segments, and tracks the count and distinct count of TargetUserName, the accounts being disabled. This pattern of disabling multiple accounts rapidly is unusual and could signal internal policy breaches or an external attacker's attempt to disrupt normal operations. Teams are advised to tailor the threshold and timeframe of this detection to their environment's specifics
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This Splunk detection focuses on instances where more than five unique Windows accounts are disabled within a 10-minute window, as indicated by Event Code 4725 in the Windows Security Event Log. The query analyzes the wineventlog_security dataset, grouping data into 10-minute segments, and tracks the count and distinct count of TargetUserName, the accounts being disabled. This pattern of disabling multiple accounts rapidly is unusual and could signal internal policy breaches or an external attacker's attempt to disrupt normal operations. Teams are advised to tailor the threshold and timeframe of this detection to their environment's specifics
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
+action.escu.known_false_positives = Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+action.escu.creation_date = 2024-02-21
+action.escu.modification_date = 2024-02-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Multiple Accounts Disabled - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = User $src_user$ disabled multiple accounts in a short period of time.
+action.risk.param._risk = [{"risk_object_field": "src_user", "risk_object_type": "other", "risk_score": 18}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Multiple Accounts Disabled - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 10"], "confidence": 60, "impact": 30, "kill_chain_phases": ["Installation", "Exploitation", "Delivery"], "mitre_attack": ["T1098", "T1078"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = This Splunk detection focuses on instances where more than five unique Windows accounts are disabled within a 10-minute window, as indicated by Event Code 4725 in the Windows Security Event Log. The query analyzes the wineventlog_security dataset, grouping data into 10-minute segments, and tracks the count and distinct count of TargetUserName, the accounts being disabled. This pattern of disabling multiple accounts rapidly is unusual and could signal internal policy breaches or an external attacker's attempt to disrupt normal operations. Teams are advised to tailor the threshold and timeframe of this detection to their environment's specifics
+action.notable.param.rule_title = Windows Multiple Accounts Disabled
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `wineventlog_security` EventCode=4725 status=success | bucket span=10m _time | stats count dc(user) as unique_users values(user) as user by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users > 5 | `windows_multiple_accounts_disabled_filter`
+
 [ESCU - Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -63825,6 +64129,86 @@ realtime_schedule = 0
 is_visible = false
 search = `cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN") | eval src_interface=src_int_prefix_long+src_int_suffix | stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(action) AS action count by host src_interface | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_port_security_violation_filter`
 
+[ESCU - Detect Remote Access Software Usage DNS - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic detects when a known remote access software domains are contacted from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.mappings = {"cis20": ["CIS 10"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Network_Resolution"]
+action.escu.eli5 = The following analytic detects when a known remote access software domains are contacted from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.how_to_implement = To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+action.escu.known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+action.escu.creation_date = 2024-02-22
+action.escu.modification_date = 2024-02-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Remote Access Software Usage DNS - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Insider Threat", "Command And Control", "Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = A domain for a known remote access software $query$ was contacted by $src$.
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "query", "risk_object_type": "other", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Remote Access Software Usage DNS - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Insider Threat", "Command And Control", "Ransomware"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution by DNS.src DNS.query | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup remote_access_software remote_domain AS query OUTPUT isutility, description as signature, comment_reference as desc, category | eval dest = query | search isutility = True | `detect_remote_access_software_usage_dns_filter`
+
+[ESCU - Detect Remote Access Software Usage Traffic - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic detects when a known remote access software application traffic is detected from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Network_Traffic"]
+action.escu.eli5 = The following analytic detects when a known remote access software application traffic is detected from within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.how_to_implement = The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+action.escu.known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+action.escu.creation_date = 2024-02-22
+action.escu.modification_date = 2024-02-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Remote Access Software Usage Traffic - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Insider Threat", "Command And Control", "Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = Application traffic for a known remote access software [$signature$] was detected from $src$.
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Remote Access Software Usage Traffic - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Insider Threat", "Command And Control", "Ransomware"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(user) as user from datamodel=Network_Traffic by All_Traffic.src All_Traffic.dest, All_Traffic.app | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `detect_remote_access_software_usage_traffic_filter`
+
 [ESCU - Detect Rogue DHCP Server - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -64414,6 +64798,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats count from datamodel=Web where Web.url="*/mgmt/tm/util/bash*" Web.http_method="POST" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`
 
+[ESCU - High Volume of Bytes Out to Url - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic detects high volume of bytes out (greater than 1GB) to a URL within 2 mins of time window. This may be indicative of an attacker attempting to exfiltrate data.  The search applies a fundamental threshold for detecting significant web uploads. This approach aims to identify potential data exfiltration activities by malware or malevolent insiders. View the alert for $dest$ to investigate further.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1567"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Web"]
+action.escu.eli5 = The following analytic detects high volume of bytes out (greater than 1GB) to a URL within 2 mins of time window. This may be indicative of an attacker attempting to exfiltrate data.  The search applies a fundamental threshold for detecting significant web uploads. This approach aims to identify potential data exfiltration activities by malware or malevolent insiders. View the alert for $dest$ to investigate further.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. Please adjust the threshold for the sum of bytes out as per your environment and user behavior.
+action.escu.known_false_positives = This search may trigger false positives if there is a legitimate reason for a high volume of bytes out to a URL. We recommend to investigate these findings. Consider updating the filter macro to exclude the applications that are relevant to your environment.
+action.escu.creation_date = 2024-02-22
+action.escu.modification_date = 2024-02-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - High Volume of Bytes Out to Url - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Data Exfiltration"]
+action.risk = 1
+action.risk.param._risk_message = A high volume of bytes out to a URL $url$ was detected from src $src$ to dest $dest$.
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 9}, {"risk_object_field": "dest", "risk_object_type": "other", "risk_score": 9}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - High Volume of Bytes Out to Url - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 30, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1567"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats  `security_content_summariesonly` count sum(Web.bytes_out) as sum_bytes_out values(Web.user) as user values(Web.app) as app values(Web.dest) as dest from datamodel=Web by _time span=2m Web.url Web.src sourcetype | search sum_bytes_out > 1070000000 | `drop_dm_object_name("Web")`| `high_volume_of_bytes_out_to_url_filter`
+
 [ESCU - Hosts receiving high volume of network traffic from email server - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -65728,10 +66152,10 @@ description = This analytic detects attempts to exploit the ConnectWise ScreenCo
 action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 action.escu.data_models = ["Web"]
 action.escu.eli5 = This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
-action.escu.how_to_implement = To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
+action.escu.how_to_implement = To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The analytic was written against Suricata. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
 action.escu.known_false_positives = False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
-action.escu.creation_date = 2024-02-21
-action.escu.modification_date = 2024-02-21
+action.escu.creation_date = 2024-02-23
+action.escu.modification_date = 2024-02-23
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - ConnectWise ScreenConnect Authentication Bypass - Rule
 action.escu.search_type = detection
@@ -65765,7 +66189,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/SetupWizard.aspx/*","*/SetupWizard/") by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status, Web.http_method, sourcetype, source | rex field=Web.url "/SetupWizard.aspx/(?<randomPath>.+)" | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_authentication_bypass_filter`
+search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*/SetupWizard.aspx/*","*/SetupWizard/") Web.status=200 Web.http_method=POST by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status, Web.http_method, sourcetype, source | rex field=Web.url "/SetupWizard.aspx/(?<randomPath>.+)" | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_authentication_bypass_filter`
 
 [ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule]
 action.escu = 0
@@ -65905,6 +66329,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.http_method="GET" OR Web.http_method="HEAD") by Web.http_method, Web.url,Web.url_length Web.src, Web.dest | search Web.url="*jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin*import*" AND Web.url_length > 200 | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table src, dest_ip, http_method, url, firstTime, lastTime | `detect_malicious_requests_to_exploit_jboss_servers_filter`
 
+[ESCU - Detect Remote Access Software Usage URL - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic detects when a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Web"]
+action.escu.eli5 = The following analytic detects when a known remote access software is executed with the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+action.escu.how_to_implement = The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+action.escu.known_false_positives = It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment.
+action.escu.creation_date = 2024-02-22
+action.escu.modification_date = 2024-02-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Remote Access Software Usage URL - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Insider Threat", "Command And Control", "Ransomware"]
+action.risk = 1
+action.risk.param._risk_message = A domain for a known remote access software $url_domain$ was contacted by $src$.
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "url_domain", "risk_object_type": "other", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Remote Access Software Usage URL - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Insider Threat", "Command And Control", "Ransomware"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1219"], "nist": ["DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats count min(_time) as firstTime max(_time) as lastTime latest(Web.http_method) as http_method latest(Web.http_user_agent) as http_user_agent latest(Web.url) as url latest(Web.user) as user latest(Web.dest) as dest from datamodel=Web by Web.action Web.src Web.category Web.url_domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("Web")` | lookup remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `detect_remote_access_software_usage_url_filter`
+
 [ESCU - Exploit Public Facing Application via Apache Commons Text - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -66466,6 +66930,144 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url="*/cli?remoting=false*" Web.status=200 Web.http_method=POST by Web.src, Web.dest, Web.http_user_agent, Web.url Web.status, Web.http_method | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jenkins_arbitrary_file_read_cve_2024_23897_filter`
 
+[ESCU - JetBrains TeamCity Authentication Bypass CVE-2024-27198 - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution. Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Web"]
+action.escu.eli5 = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution. Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+action.escu.how_to_implement = The detection relies on the Web datamodel and a CIM compliant log source, that may include Nginx, TeamCity logs, or other web server logs.
+action.escu.known_false_positives = False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
+action.escu.creation_date = 2024-03-04
+action.escu.modification_date = 2024-03-04
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - JetBrains TeamCity Authentication Bypass CVE-2024-27198 - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["JetBrains TeamCity Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Possible JetBrains TeamCity Authentication Bypass CVE-2024-27198 Attempt against $dest$ from $src$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "src", "risk_object_type": "other", "risk_score": 81}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - JetBrains TeamCity Authentication Bypass CVE-2024-27198 - Rule
+action.correlationsearch.annotations = {"analytic_story": ["JetBrains TeamCity Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 90, "cve": ["CVE-2024-27198"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution. Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+action.notable.param.rule_title = JetBrains TeamCity Authentication Bypass CVE-2024-27198
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where ((Web.url="*?jsp=*" AND Web.url="*;.jsp*") Web.status=200 Web.http_method=POST) OR (Web.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") Web.status=200 Web.http_method=POST ) by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status, Web.http_method, sourcetype, source | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter`
+
+[ESCU - JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution.Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution.Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+action.escu.how_to_implement = The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
+action.escu.known_false_positives = False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
+action.escu.creation_date = 2024-03-04
+action.escu.modification_date = 2024-03-04
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["JetBrains TeamCity Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Possible JetBrains TeamCity Authentication Bypass Attempt against $dest$ from $src$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "src", "risk_object_type": "other", "risk_score": 81}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 - Rule
+action.correlationsearch.annotations = {"analytic_story": ["JetBrains TeamCity Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 90, "cve": ["CVE-2024-27198"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The CVE-2024-27198 vulnerability presents a critical security risk for JetBrains TeamCity on-premises servers, allowing attackers to bypass authentication mechanisms and gain unauthorized access. This vulnerability can be exploited in several ways, each leading to the attacker gaining full control over the TeamCity server, including all associated projects, builds, agents, and artifacts. One method of exploitation involves creating a new administrator user. An attacker, without needing to authenticate, can send a specially crafted POST request to the `/app/rest/users` REST API endpoint. This request includes the desired username, password, email, and roles for the new user, effectively granting them administrative privileges upon successful execution.Alternatively, an attacker can generate a new administrator access token by targeting the `/app/rest/users/id:1/tokens` endpoint with a POST request. This method also does not require prior authentication and results in the creation of a token that grants administrative access. Both exploitation methods underscore the severity of the CVE-2024-27198 vulnerability and highlight the importance of securing TeamCity servers against such authentication bypass threats. The manipulation of URI paths `/app/rest/users` and `/app/rest/users/id:1/tokens` through malicious requests enables attackers to gain unauthorized access and control, emphasizing the need for immediate remediation measures.
+action.notable.param.rule_title = JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `suricata` ((http.url="*?jsp=*" AND http.url="*;.jsp*") http.status=200 http_method=POST) OR (http.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") http.status=200 http_method=POST ) | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, http.http_user_agent, http.url, http.status,http_method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198_filter`
+
+[ESCU - JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = CVE-2024-27199 reveals a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated attackers to bypass authentication for a limited set of endpoints. This vulnerability exploits path traversal issues, enabling attackers to access and potentially modify system settings or disclose sensitive server information without proper authentication. Identified vulnerable paths include /res/, /update/, and /.well-known/acme-challenge/, among others. Attackers can manipulate these paths to reach restricted JSP pages and servlet endpoints, such as /app/https/settings/uploadCertificate, which could allow for the uploading of malicious HTTPS certificates or modification of server settings. This detection aims to identify potential exploitation attempts by monitoring for unusual access patterns to these endpoints, which could indicate an authentication bypass attempt in progress.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = CVE-2024-27199 reveals a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated attackers to bypass authentication for a limited set of endpoints. This vulnerability exploits path traversal issues, enabling attackers to access and potentially modify system settings or disclose sensitive server information without proper authentication. Identified vulnerable paths include /res/, /update/, and /.well-known/acme-challenge/, among others. Attackers can manipulate these paths to reach restricted JSP pages and servlet endpoints, such as /app/https/settings/uploadCertificate, which could allow for the uploading of malicious HTTPS certificates or modification of server settings. This detection aims to identify potential exploitation attempts by monitoring for unusual access patterns to these endpoints, which could indicate an authentication bypass attempt in progress.
+action.escu.how_to_implement = The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
+action.escu.known_false_positives = False positives are not expected, however, monitor, filter, and tune as needed based on organization log sources. The analytic is restricted to 200 and GET requests to specific URI paths, which should limit false positives.
+action.escu.creation_date = 2024-03-04
+action.escu.modification_date = 2024-03-04
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["JetBrains TeamCity Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = Possible JetBrains TeamCity Limited Authentication Bypass Attempt against $dest$ from $src$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "src", "risk_object_type": "other", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 - Rule
+action.correlationsearch.annotations = {"analytic_story": ["JetBrains TeamCity Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 70, "cve": ["CVE-2024-27199"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = CVE-2024-27199 reveals a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated attackers to bypass authentication for a limited set of endpoints. This vulnerability exploits path traversal issues, enabling attackers to access and potentially modify system settings or disclose sensitive server information without proper authentication. Identified vulnerable paths include /res/, /update/, and /.well-known/acme-challenge/, among others. Attackers can manipulate these paths to reach restricted JSP pages and servlet endpoints, such as /app/https/settings/uploadCertificate, which could allow for the uploading of malicious HTTPS certificates or modification of server settings. This detection aims to identify potential exploitation attempts by monitoring for unusual access patterns to these endpoints, which could indicate an authentication bypass attempt in progress.
+action.notable.param.rule_title = JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `suricata` http.url IN ("*../admin/diagnostic.jsp*", "*../app/https/settings/*", "*../app/pipeline*", "*../app/oauth/space/createBuild.html*", "*../res/*", "*../update/*", "*../.well-known/acme-challenge/*", "*../app/availableRunners*", "*../app/https/settings/setPort*", "*../app/https/settings/certificateInfo*", "*../app/https/settings/defaultHttpsPort*", "*../app/https/settings/fetchFromAcme*", "*../app/https/settings/removeCertificate*", "*../app/https/settings/uploadCertificate*", "*../app/https/settings/termsOfService*", "*../app/https/settings/triggerAcmeChallenge*", "*../app/https/settings/cancelAcmeChallenge*", "*../app/https/settings/getAcmeOrder*", "*../app/https/settings/setRedirectStrategy*") http.status=200 http_method=GET | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, http_user_agent, http.url, http.status, http_method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199_filter`
+
 [ESCU - JetBrains TeamCity RCE Attempt - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -66482,7 +67084,7 @@ action.escu.full_search_name = ESCU - JetBrains TeamCity RCE Attempt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["JetBrains TeamCity Unauthenticated RCE", "CISA AA23-347A"]
+action.escu.analytic_story = ["JetBrains TeamCity Unauthenticated RCE", "CISA AA23-347A", "JetBrains TeamCity Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = Potential JetBrains TeamCity RCE Attempt detected against URL $url$ on $dest$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "url", "risk_object_type": "other", "risk_score": 81}, {"risk_object_field": "src", "risk_object_type": "other", "risk_score": 81}]
@@ -66493,7 +67095,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - JetBrains TeamCity RCE Attempt - Rule
-action.correlationsearch.annotations = {"analytic_story": ["JetBrains TeamCity Unauthenticated RCE", "CISA AA23-347A"], "cis20": ["CIS 13"], "confidence": 90, "cve": ["CVE-2023-42793"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["JetBrains TeamCity Unauthenticated RCE", "CISA AA23-347A", "JetBrains TeamCity Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 90, "cve": ["CVE-2023-42793"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -66730,6 +67332,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` values(Web.url) as urls min(_time) as firstTime from datamodel=Web by Web.src | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `brand_abuse_web` | `monitor_web_traffic_for_brand_abuse_filter`
 
+[ESCU - Nginx ConnectWise ScreenConnect Authentication Bypass - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
+action.escu.how_to_implement = To implement this analytic, ensure proper logging is occurring with Nginx, access.log and error.log, and that these logs are being ingested into Splunk. STRT utilizes this nginx.conf https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec to properly log as much data with Nginx.
+action.escu.known_false_positives = False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
+action.escu.creation_date = 2024-02-23
+action.escu.modification_date = 2024-02-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Nginx ConnectWise ScreenConnect Authentication Bypass - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["ConnectWise ScreenConnect Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = An authentication bypass attempt against ScreenConnect has been detected on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Nginx ConnectWise ScreenConnect Authentication Bypass - Rule
+action.correlationsearch.annotations = {"analytic_story": ["ConnectWise ScreenConnect Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 100, "cve": ["CVE-2024-1708", "CVE-2024-1709"], "impact": 100, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. The vulnerability, identified as critical with a CVSS score of 10, enables unauthorized users to access the SetupWizard.aspx page on already-configured ScreenConnect instances, potentially leading to the creation of administrative users and remote code execution. The search query provided looks for web requests to the SetupWizard.aspx page that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
+action.notable.param.rule_title = Nginx ConnectWise ScreenConnect Authentication Bypass
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `nginx_access_logs` uri_path IN ("*/SetupWizard.aspx/*","*/SetupWizard/") status=200 http_method=POST  | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, http_user_agent, url, uri_path, status, http_method, sourcetype, source | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nginx_connectwise_screenconnect_authentication_bypass_filter`
+
 [ESCU - PaperCut NG Remote Web Access Attempt - Rule]
 action.escu = 0
 action.escu.enabled = 1

dist/DA-ESS-ContentUpdate/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############
@@ -403,7 +403,7 @@ filename = remote_access_software.csv
 default_match = false
 case_sensitive_match = false
 # description = A list of Remote Access Software
-match_type = WILDCARD(remote_software)
+match_type = WILDCARD(remote_utility),WILDCARD(remote_domain),WILDCARD(remote_utility_fileinfo)
 min_matches = 1
 
 [s3_deletion_baseline]

dist/DA-ESS-ContentUpdate/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2024-02-22T18:55:44 UTC
+# On Date: 2024-03-06T22:17:33 UTC
 # Author: Splunk Threat Research Team - Splunk
 # Contact: research@splunk.com
 #############

dist/DA-ESS-ContentUpdate/lookups/remote_access_software.csv

@@ -1,54 +1,569 @@
-remote_utility, description, isutility
-aweray_remote*.exe,AweRay (AweSun), TRUE
-aa_v*.exe, Ammyy Admin, TRUE
-AeroAdmin.exe, AeroAdmin, TRUE
-anydesk.exe, AnyDesk, TRUE
-AnyViewerSetup.exe, AnyViewer, TRUE
-RCClient.exe, AnyViewer, TRUE
-CService.exe, AnyViewer, TRUE
-atera_agent.exe, Atera, TRUE
-bomgar-scc.exe, BeyondTrust (Bomgar), TRUE
-bomgar-rdp.exe, BeyondTrust (Bomgar), TRUE
-screenconnect.clientservice.exe, ConnectWise Control, TRUE
-screenconnect.windowsclient.exe, ConnectWise Control, TRUE
-dwrcs.exe, Dameware, TRUE
-distant-desktop.exe, Distant Desktop, TRUE
-dwagsvc.exe, DW Service, TRUE
-g2comm.exe, GoToMyPC, TRUE
-g2fileh.exe, GoToMyPC, TRUE
-g2host.exe, GoToMyPC, TRUE
-g2mainh.exe, GoToMyPC, TRUE
-g2printh.exe, GoToMyPC, TRUE
-g2svc.exe, GoToMyPC, TRUE
-g2tray.exe, GoToMyPC, TRUE
-gopcsrv.exe, GoToMyPC, TRUE
-ROMServer.exe, LiteManager, TRUE 
-ROMFUSClient.exe, LiteManager, TRUE
-lmiignition.exe, LogMeIn, TRUE
-lmiguardiansvc.exe, LogMeIn, TRUE
-logmein*.exe, LogMeIn, TRUE
-awrem32.exe, PCAnywhere Client, TRUE
-awhost32.exe, PCAnywhere Server, TRUE
-PCMonitorManager.exe, Pulseway, TRUE
-pcmonitorsrv.exe, Pulseway, TRUE
-radmin3.exe, RAdmin, TRUE
-famitrfc.exe, RAdmin,  TRUE
-rutserv.exe, RemoteUtilities, TRUE
-smpcsetup.exe, ShowMyPC, TRUE
-showmypc*.exe, ShowMyPC, TRUE
-strwinclt.exe, Splashtop, TRUE
-supremo.exe, Supremo, TRUE
-supremohelper.exe, Supremo, TRUE
-supremosystem.exe, Supremo, TRUE
-teamviewer_desktop.exe, TeamViewer Desktop, TRUE
-teamviewer.exe, TeamViewer Service, TRUE
-teamviewer_service.exe, TeamViewer Service, TRUE
-winvnc.exe, VNC, TRUE
-vncviewer.exe, VNC, TRUE
-winvncsc.exe, VNC, TRUE
-winwvc.exe, VNC, TRUE
-Zaservice.exe, Zoho Assist, TRUE
-Zohours.exe, Zoho Assist, TRUE
-ZohoMeeting.exe, Zoho Assist, TRUE
-meshagent.exe, MeshAgent, TRUE
-tacticalrmm.exe, Tactical RMM, TRUE
+description,remote_domain,remote_utility,remote_utility_fileinfo,remote_appid,isutility,category,comment_reference,last_update
+247ithelp.com (ConnectWise),*.247ithelp.com,Remote Workforce Client.exe,,,TRUE,RMM,Simlar / replaced by ScreenConnect,2/8/2024
+Access Remote PC,,rpcgrab.exe,,,TRUE,RMM,,2/7/2024
+Access Remote PC,,rpcsetup.exe,,,TRUE,RMM,,2/7/2024
+Acronic Cyber Protect (Remotix),cloud.acronis.com,AcronisCyberProtectConnectQuickAssist*.exe,Acronis Cyber Protect Connect Quick Assist,remotix,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Acronic Cyber Protect (Remotix),agents*-cloud.acronis.com,AcronisCyberProtectConnectAgent.exe,Acronis Cyber Protect Connect Agent,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Acronic Cyber Protect (Remotix),gw.remotix.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Acronic Cyber Protect (Remotix),connect.acronis.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Action1,*.action1.com,action1_agent.exe,Action1*,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Action1,action1.com,action1_remote.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Action1,a1-backend-packages.s3.amazonaws.com,action1_connector.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Action1,server.action1.com,action1_update.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Addigy,prod.addigy.com,addigy-*.pkg,Addigy*,,TRUE,RMM,https://addigy.com/,2/27/2024
+Addigy,grtmprod.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024
+Addigy,agents.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024
+Adobe Connect,*.adobeconnect.com,ConnectAppSetup*.exe,Adobe Connect,adobe-connect,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+Adobe Connect,,ConnectShellSetup*.exe,,adobe-meeting-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+Adobe Connect,,Connect.exe,,adobe-connectnow,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+Adobe Connect,,ConnectDetector.exe,,adobe-connectnow-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+AeroAdmin,auth*.aeroadmin.com,aeroadmin.exe,AeroAdmin*,aeroadmin,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024
+AeroAdmin,aeroadmin.com,,Aero Admin*,,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024
+AliWangWang-remote-control,wangwang.taobao.com,alitask.exe,AliWangWang*,ali-wangwang,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024
+AliWangWang-remote-control,,,,ali-wangwang-remote-control,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024
+Alpemix,*.alpemix.com,alpemix.exe,Alpemix*,alpemix,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024
+Alpemix,*.teknopars.com,,Teknopars*,,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024
+Ammyy Admin,*ammyy.com,aa_v*.exe,Ammyy*,ammyy-admin,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024
+Ammyy Admin,,AMMYY_Admin.exe,,,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024
+Any Support,*.anysupport.net,ManualLauncher.exe,AnySupport*,anysupport,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024
+Any Support,,,"Koino Co., Ltd.",,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024
+AnyDesk,net.anydesk.com,anydesk.exe,anydesk*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024
+AnyDesk,,,philandro Software*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024
+Anyplace Control,anyplace-control.com,apc_host.exe,Anyplace*,anyplace-remote-control,TRUE,RMM,http://www.anyplace-control.com/anyplace-control/help/faq.htm,2/7/2024
+AnyViewer,controlserver.anyviewer.com,AnyViewerSetup.exe,AOMEI*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
+AnyViewer,*.aomeisoftware.com,RCClient.exe,Anyviewer*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
+AnyViewer,aomeisoftware.com,RCService.exe,,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
+Apple Remote Desktop,user_managed,ARDAgent.app,,apple-remote-desktop,TRUE,RMM,https://support.apple.com/guide/remote-desktop/install-and-set-up-remote-desktop-apdf49e03a4/mac,2/24/2024
+Atera RMM,agent-api.atera.com,atera_agent.exe,Atera Networks,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
+Atera RMM,pubsub.atera.com,ateraagent.exe,AteraAgent,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
+Atera RMM,,syncrosetup.exe,,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
+Auvik,*.my.auvik.com,auvik.engine.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024
+Auvik,*.auvik.com,auvik.agent.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024
+AweRay,asapi*.aweray.net,aweray_remote*.exe,AweRay*,awesun,TRUE,RMM,https://sun.aweray.com/help,2/7/2024
+AweRay,client-api.aweray.com,AweSun.exe,AweSun*,,TRUE,RMM,https://sun.aweray.com/help,2/7/2024
+Barracuda,*.islonline.net,,Barracuda MSP,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
+Barracuda,rmm.barracudamsp.com,,Barracuda Networks,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
+Barracuda,,,LPI Level Platforms,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
+Basecamp,,,,,TRUE,RMM,basecamp.com - No specific RMM tool listed,2/7/2024
+BeamYourScreen,beamyourscreen.com,beamyourscreen.exe,BeamYourScreen*,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024
+BeamYourScreen,*.beamyourscreen.com,beamyourscreen-host.exe,,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024
+BeAnywhere,beanywhere.com,BASupConHelper.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnywhere,*.beanywhere.com,BASupSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnywhere,,BASupSrvcCnfg.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnywhere,,BASupSrvcUpdater.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupSysInf.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupAppSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupAppElev.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,TakeControl.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeInSync,*.beinsync.net,Beinsync*.exe,BeInSync,beinsync,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024
+BeInSync,*.beinsync.com,,BeInSync Client GUI,,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024
+BeyondTrust (Bomgar),*.beyondtrustcloud.com,bomgar-scc-*.exe,BeyondTrust*,beyond-trust-remote-support,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),*.bomgarcloud.com,bomgar-scc.exe,Bomgar*,bomgar,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),bomgarcloud.com,bomgar-pac-*.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),,bomgar-pac.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),,bomgar-rdp.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+CentraStage (Now Datto),*.rmm.datto.com,CagService.exe,Datto*,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024
+CentraStage (Now Datto),*cc.centrastage.net,AEMAgent.exe,,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024
+Centurion,centuriontech.com,ctiserv.exe,,,TRUE,RMM,https://data443.atlassian.net/servicedesk/customer/portal/20,2/7/2024
+Chrome Remote Desktop,*remotedesktop.google.com,remote_host.exe,Chrome Remote Desktop,chrome-remote-desktop,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024
+Chrome Remote Desktop,*remotedesktop-pa.googleapis.com,remoting_host.exe,,,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024
+CloudFlare Tunnel,,cloudflared.exe,,,TRUE,Remote Access,cloudflare.com/products/tunnel/,2/7/2024
+Comodo RMM,*.itsm-us1.comodo.com,itsmagent.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024
+Comodo RMM,*mdmsupport.comodo.com,rviewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024
+Connectwise Automate (LabTech),*.hostedrmm.com,ltsvc.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
+Connectwise Automate (LabTech),,ltsvcmon.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
+Connectwise Automate (LabTech),,lttray.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
+CrossLoop,*.crossloop.com,crossloopservice.exe,Crossloop*,crossloop,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
+CrossLoop,,CrossLoopConnect.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
+CrossLoop,,WinVNCStub.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
+CrossTec Remote Control,user_managed,PCIVIDEO.EXE,CrossTec,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024
+CrossTec Remote Control,,supporttool.exe,,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024
+CruzControl,,,,,TRUE,RMM,https://resources.doradosoftware.com/cruz-rmm,2/7/2024
+Dameware,user_managed,dntus*.exe,DameWare*,dameware-mini-remote,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+Dameware,,dwrcs.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,DameWare Remote Support.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,SolarWinds-Dameware-MRC*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,DameWare Mini Remote Control*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,SolarWinds-Dameware-DRS*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DeskDay,deskday.ai,ultimate_*.exe,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024
+DeskDay,app.deskday.ai,,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024
+DeskNets,,,,desknets,TRUE,RMM,https://www.desknets.com/en/download.html,2/26/2024
+DeskShare,user_managed,TeamTaskManager.exe,Team Task Manager*,deskshare,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024
+DeskShare,,DSGuest.exe,DeskShare*,,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024
+DesktopNow,*.nchuser.com,desktopnow.exe,DesktopNow*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024
+DesktopNow,,,NCH Software*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024
+Distant Desktop,*.distantdesktop.com,distant-desktop.exe,Distant Software*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
+Distant Desktop,*signalserver.xyz,dd.exe,Distant Desktop*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
+Distant Desktop,,ddsystem.exe,German Gorodokuplya*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
+Domotz,*.domotz.co,domotz*.exe,Domotz*,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,*cell-1.domotz.com,domotz_bash.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,domotz.com,domotz-windows*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,,Domotz Pro Desktop App.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,,Domotz Pro Desktop App Setup*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,,domotz.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+DW Service,*.dwservice.net,dwagsvc.exe,DWSNET*,dws-remote-control,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
+DW Service,,dwagent.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
+DW Service,,dwagsvc.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
+Echoware,,echoserver*.exe,,echoware,TRUE,RMM,,2/7/2024
+Echoware,,echoware.dll,,,TRUE,RMM,,2/7/2024
+Electric AI (Kaseya),,,,,TRUE,RMM,https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf,2/7/2024
+EMCO Remote Console,user_managed,remoteconsole.exe,,,TRUE,RMM,,2/7/2024
+Encapto,,,,,TRUE,RMM,https://www.encapto.com - used to manage Cisco services,2/7/2024
+Ericom AccessNow,user_managed,accessserver*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
+Ericom Connect,user_managed,EricomConnectRemoteHost*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
+Ericom Connect,,ericomconnnectconfigurationtool.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
+ESET Remote Administrator,user_managed,era.exe,ESET Management*,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,einstaller.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,ezhelp*.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,eratool.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,ERAAgent.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ezHelp,*.ezhelp.co.kr,ezhelpclientmanager.exe,Mastersoft Corp*,ezhelp,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
+ezHelp,,ezHelpManager.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
+ezHelp,,ezhelpclient.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
+FastViewer,*.fastviewer.com,fastclient.exe,Fastviewer*,fastviewer,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
+FastViewer,,fastmaster.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
+FastViewer,,FastViewer.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
+FixMe.it,*.fixme.it,FixMeit Unattended Access Setup.exe,FixMe*,techinline,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,*.techinline.net,TiExpertStandalone.exe,SetMe*,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,fixme.it,FixMeitClient*.exe,FixMe.IT Helper,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,*set.me,FixMeit Client.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,*setme.net,FixMeit Expert Setup.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,TiExpertCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,fixmeitclient.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,TiClientCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,TiClientHelper*.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FleetDesk.io,*.fleetdeck.io,fleetdeck_agent_svc.exe,FleetDeck*,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,cognito-idp.us-west-2.amazonaws.com,fleetdeck_commander_svc.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,fleetdeck.io,fleetdeck_installer.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,,fleetdeck_agent.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,,fleetdeck_commander_launcher.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+Fortra,,,,,TRUE,RMM,https://www.fortra.com - No free/cloud RMM softwars listed,2/7/2024
+GatherPlace-desktop sharing,*.gatherplace.com,gp3.exe,Gatherworks*,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
+GatherPlace-desktop sharing,*.gatherplace.net,gp4.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
+GatherPlace-desktop sharing,,gp5.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
+GetScreen,*.getscreen.me,getscreen.exe,getscreen.me*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024
+GetScreen,getscreen.me,,Point B Ltd*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024
+GoToAssist,goto.com,gotoassist.exe,GoToAssist*,gotoassist,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.getgo.com,g2a*.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.fastsupport.com,GoTo Assist Opener.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.gotoassist.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,helpme.net,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.gotoassist.me,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.gotoassist.at,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.desktopstreaming.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GotoHTTP,gotohttp.com,gotohttp.exe,GotoHTTP*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024
+GotoHTTP,*.gotohttp.com,GotoHTTP_x64.exe,Pingbo*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024
+GoToMyPC,*.GoToMyPC.com,g2file*.exe,GoTo Opener,gotomypc,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2quick.exe,GoToOpener,gotomypc-base,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2svc.exe,,gotomypc-desktop-sharing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2tray.exe,,gotomypc-remote-control,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2svc.exe,,gotomypc-printing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2printh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2fileh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2tray.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,gopcsrv.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2host.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2comm.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2mainh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+Goverlan,user_managed,goverrmc.exe,Goverlan*,goverlan,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,govsrv*.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,GovAgentInstallHelper.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,GovAgentx64.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,GovReachClient.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Guacamole,user_managed,guacd.exe,,,TRUE,RMM,guacamole.apache.org,2/8/2024
+HelpBeam,,helpbeam*.exe,,,TRUE,RMM,https://www.helpbeam.com domain for sale in 2024,2/8/2024
+HelpU,helpu.co.kr,helpu_install.exe,helpU*,helpu,TRUE,RMM,https://helpu.co.kr/,2/8/2024
+HelpU,*.helpu.co.kr,HelpuUpdater.exe,Help Manager Program,,TRUE,RMM,https://helpu.co.kr/,2/8/2024
+HelpU,,HelpuManager.exe,,,TRUE,RMM,https://helpu.co.kr/,2/8/2024
+I'm InTouch,*.01com.com,iit.exe,I'm InTouch*,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
+I'm InTouch,,intouch.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
+I'm InTouch,,I'm InTouch Go Installer.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
+Instant Housecall,*.instanthousecall.com,hsloader.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+Instant Housecall,*.instanthousecall.net,ihcserver.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+Instant Housecall,instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+Instant Housecall,secure.instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+IntelliAdmin Remote Control,user_managed,iadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,*.intelliadmin.com,intelliadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,,agent32.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,,agent64.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,,agent_setup_5.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+Iperius Remote,*.iperiusremote.com,iperius.exe,Enter Srl*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
+Iperius Remote,*.iperius.com,iperiusremote.exe,Enter S.R.L*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
+Iperius Remote,*.iperius-rs.com,,Iperius Remote*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
+ISL Online,*.islonline.com,islalwaysonmonitor.exe,ISL Online*,isl-light,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+ISL Online,*.islonline.net,isllight.exe,ISL Light*,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+ISL Online,,isllightservice.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+ISL Online,,ISLLightClient.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+Itarian,*.itsm-us1.comodo.com,ITSMAgent.exe,Itarian*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,mdmsupport.comodo.com,ItsmRsp.exe,RMM*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,*.cmdm.comodo.com,ITSMService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,remoteaccess.itarian.com,RDesktop.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,servicedesk.itarian.com,RHost.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,RmmService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,ComodoRemoteControl.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,RAccess.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,RViewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,ITarianRemoteAccessSetup.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+ITSupport247 (ConnectWise),*.itsupport247.net,saazapsc.exe,,,TRUE,RMM,https://control.itsupport247.net/,2/8/2024
+Ivanti Remote Control,*.ivanticloud.com,IvantiRemoteControl.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
+Ivanti Remote Control,,ArcUI.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
+Ivanti Remote Control,,AgentlessRC.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
+Jump Cloud,*.api.jumpcloud.com,JumpCloud*.exe ,JumpCloud*,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024
+Jump Cloud,*.assist.jumpcloud.com,,,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024
+Jump Desktop,*.jumpdesktop.com,jumpclient.exe,,jumpdesktop,TRUE,RMM,https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect,2/9/2024
+Jump Desktop,jumpdesktop.com,jumpdesktop.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Jump Desktop,jumpto.me,jumpservice.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Jump Desktop,*.jumpto.me,jumpconnect.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Jump Desktop,,jumpupdater.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Kabuto,*.kabuto.io,Kabuto.App.Runner.exe,,,TRUE,RMM,https://www.repairtechsolutions.com/documentation/kabuto/,2/8/2024
+Kaseya (VSA),deploy01.kaseya.com,agentmon.exe,Kaseya*,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
+Kaseya (VSA),*managedsupport.kaseya.net,KaUpdHlp.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
+Kaseya (VSA),*.kaseya.net,KaUsrTsk.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
+KHelpDesk,*.khelpdesk.com.br,KHelpDesk.exe,KHELPDESK*,khelpdesk-remote-control,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024
+KHelpDesk,,,Ferramenta de Acesso Remoto,,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024
+KickIdler,kickidler.com,grabberEM.*msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024
+KickIdler,my.kickidler.com,grabberTT*.msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024
+LANDesk,*.ivanticloud.com,issuser.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,*.ivanti.com,landeskagentbootstrap.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,,LANDeskPortalManager.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,,ldinv32.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,,ldsensors.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+Laplink Everywhere,everywhere.laplink.com,laplink.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,le.laplink.com,laplink-everywhere-setup*.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,atled.syspectr.com,laplinkeverywhere.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,,llrcservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,,serverproxyservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,,OOSysAgent.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Gold,user_managed,tsircusr.exe,,,TRUE,RMM,wen.laplink.com/product/laplink-gold,2/8/2024
+Level.io,level.io,level-windows-amd64.exe,Level*,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
+Level.io,*.level.io,level.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
+Level.io,,level-remote-control-ffmpeg.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
+LiteManager,*.litemanager.ru,romfusclient.exe,Yakhnovets Denis*,litemanager,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LiteManager,*.litemanager.com,romviewer.exe,ROMServer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LiteManager,,romserver.exe,ROMViewer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LiteManager,,lmnoipserver.exe,LiteManager*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LogMeIn,*logmein.eu,lmiguardiansvc.exe,LogMeIn*,logmein,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,*.logmeininc.com,lmiignition.exe,RemotelyAnywhere*,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,*.logmein.com,logmein.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,,logmeinsystray.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,,logmein*.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,,lmiignition.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn rescue,*.logmeinrescue.com,support-logmeinrescue*.exe,,logmeinrescue,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
+LogMeIn rescue,*.logmeinrescue.eu,support-logmeinrescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
+LogMeIn rescue,,lmi_rescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
+Manage Engine (Desktop Central),desktopcentral.manageengine.com,dcagentservice.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),desktopcentral.manageengine.com.eu,dcagentregister.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),desktopcentral.manageengine.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),*.dms.zoho.com,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),*.dms.zoho.com.eu,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),*.-dms.zoho.com.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+MeshCentral,user_managed,meshcentral*.exe,meshcentral,,TRUE,RMM,https://ylianst.github.io/MeshCentral/meshcentral/,2/8/2024
+Microsoft Quick Assist,user_managed,quickassist.exe,,ms-quick-assist,TRUE,Built-in,https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca,2/9/2024
+Microsoft RDP,,mstsc.exe,,ms-rdp,TRUE,Built-in,https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windows,2/8/2024
+Microsoft TSC,,termsrv.exe,,,TRUE,Built-in,https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/terminal-server-startup-connection-application,2/8/2024
+Mikogo,*.real-time-collaboration.com,mikogo.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+Mikogo,*.mikogo4.com,mikogo-starter.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+Mikogo,*.mikogo.com,mikogo-service.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+Mikogo,,mikogolauncher.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+MioNet (WD Anywhere Access),,mionet.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024
+MioNet (WD Anywhere Access),,mionetmanager.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024
+mRemoteNG,user_managed,mRemoteNG.exe,,,TRUE,RMM,https://github.com/mRemoteNG/mRemoteNG,2/9/2024
+MSP360,*.cloudberrylab.com,Online Backup.exe,MSP360*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,*.msp360.com,CBBackupPlan.exe,Cloud.Ra*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,*.mspbackups.com,Cloud.Backup.Scheduler.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,Cloud.Backup.RM.Service.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,cbb.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaService.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaSd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaCmd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaUtilities.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,Remote Desktop.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,Connect.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MyGreenPC,*mygreenpc.com,mygreenpc.exe,,mygreenpc,TRUE,RMM,http://www.mygreenpc.com/,2/26/2024
+MyIVO,,myivomgr.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024
+MyIVO,,myivomanager.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024
+N-Able Advanced Monitoring Agent,*remote.management,Agent_*_RW.exe,N-Able*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.logicnow.com,BASEClient.exe,Remote Monitoring*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*systemmonitor.us,BASupApp.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*systemmonitor.eu.com,BASupSrvc.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*system-monitor.com,BASupSrvcCnfg.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,systemmonitor.us.cdn.cloudflare.net,BASupTSHelper.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*cloudbackup.management,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*systemmonitor.co.uk,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.n-able.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.beanywhere.com ,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.swi-tc.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+NateOn-desktop sharing,*.nate.com,nateon*.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
+NateOn-desktop sharing,,nateon.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
+NateOn-desktop sharing,,nateonmain.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
+Naverisk,user_managed,AgentSetup-*.exe,naverisk*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024
+Naverisk,,,NavMK1 Limited*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024
+Netop Remote Control (Impero Connect),*.connect.backdrop.cloud,nhostsvc.exe,Impero Solutions*,netop-remote-control,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),*.netop.com,nhstw32.exe,Impero Connect*,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,ngstw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,Netop Ondemand.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,nldrw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,rmserverconsolemediator.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,ImperoInit.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,Connect.Backdrop.cloud*.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,ImperoClientSVC.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/8/2024
+Netreo,charon.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
+Netreo,activation.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
+Netreo,*.api.netreo.com,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
+NetSupport Manager,*.netsupportmanager.com,pcictlui.exe,netsupport,netsupport-manager,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
+NetSupport Manager,,pcicfgui.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
+NetSupport Manager,,client32.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
+Neturo,neturo.uplus.co.kr,neturo*.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024
+Neturo,,ntrntservice.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024
+Netviewer (GoToMeet),,nvClient.exe,Algorius*,netviewer,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024
+Netviewer (GoToMeet),,netviewer.exe,,,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024
+ngrok,user_managed,ngrok.exe,,,TRUE,Developer Utility,https://ngrok.com/docs/guides/running-behind-firewalls/,2/9/2024
+NinjaRMM,*.ninjaone.com,ninjarmmagent.exe,NinjaRMM*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024
+NinjaRMM,*.ninjarmm.com,NinjaRMMAgenPatcher.exe,Ninja MSP*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024
+NoMachine,user_managed,nomachine*.exe,NoMachine*,nomachine,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
+NoMachine,,nxservice*.ese,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
+NoMachine,,nxd.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
+NTR Remote,*.ntrsupport.com,NTRsupportPro_EN.exe,Net Transmit & Receive SL,ntr-remote,TRUE,RMM,DOA as of 2024,2/26/2024
+OCS inventory,user_managed,ocsinventory.exe,Ocs Inventory*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024
+OCS inventory,,ocsservice.exe,OcsPackager*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024
+OptiTune,*.optitune.us,OTService.exe,Bravura Software*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024
+OptiTune,*.opti-tune.com,OTPowerShell.exe,OptiTune*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024
+Pandora RC (eHorus),portal.ehorus.com,ehorus standalone.exe,eHorus*,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
+Pandora RC (eHorus),,ehorus_agent.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
+Panorama9,trusted.panorama9.com,p9agent*.exe,Panorama9*,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024
+Panorama9,changes.panorama9.com,,,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024
+Parallels Access,*.parallels.com,prl_deskctl_agent.exe,Parallels Access*,parallels-access,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+Parallels Access,,prl_deskctl_wizard.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+Parallels Access,,prl_pm_service.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+Parallels Access,,parallelsaccess-*.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+pcAnywhere,user_managed,awhost32.exe,,pcanywhere,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
+pcAnywhere,,pcaquickconnect.exe,,pcanywhere-remote-control,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
+pcAnywhere,,winaw32.exe,,pcanywhere-base,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
+Pcnow,,mwcliun.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
+Pcnow,,pcnmgr.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
+Pcnow,,webexpcnow.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
+Pcvisit,*.pcvisit.de,pcvisit.exe,pcvisit*,pcvisit,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+Pcvisit,,pcvisit_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+Pcvisit,,pcvisit-easysupport.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+Pcvisit,,pcvisit_service_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+PDQ Connect,app.pdq.com,pdq-connect*.exe,PDQ.com*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024
+PDQ Connect,cfcdn.pdq.com,,PDQConnectAgent*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024
+Pilixo,*.pilixo.com,Pilixo_Installer*.exe,Pilixo*,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls,2/9/2024
+Pilixo,pilixo.com,rdp.exe,,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141862-pilixo-anti-virus-and-anti-malware-exclusion-recommendations,2/9/2024
+Pilixo,download.pilixo.com,,,,TRUE,RMM,pilixo domain DOA as of 2024,2/9/2024
+Pocket Cloud (Wyse),,pocketcloud*.exe,PocketCloud*,pocket-cloud,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024
+Pocket Cloud (Wyse),,pocketcloudservice.exe,,,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024
+Pocket Controller (Soti Xsight),*soti.net,pocketcontroller.exe,Pocket Controller*,pocket-controller,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
+Pocket Controller (Soti Xsight),,wysebrowser.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
+Pocket Controller (Soti Xsight),,XSightService.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
+PSEXEC,user_managed,psexec.exe,Sysinternals PsExec,psexec,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024
+PSEXEC,,psexecsvc.exe,PsExec*,,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024
+PSEXEC (Clone),user_managed,paexec.exe,Power Admin*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024
+PSEXEC (Clone),,PAExec-*.exe,PAExec*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024
+PSEXEC (Clone),,csexec.exe ,,,TRUE,Remote Access,https://github.com/malcomvetter/CSExec,2/9/2024
+PSEXEC (Clone),,remcom.exe,Remote System Deployment*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024
+PSEXEC (Clone),,remcomsvc.exe,Remote Command Executor*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024
+PSEXEC (Clone),,xcmd.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024
+PSEXEC (Clone),,xcmdsvc.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024
+PulseWay,user_managed,pcmonitorsrv.exe,Pulseway*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024
+Pulseway,,PCMonitorManager.exe,MMSoft Design*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024
+QQ IM-remote assistance,*.mdt.qq.com,qq.exe,Tencent*,qq,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
+QQ IM-remote assistance,*.desktop.qq.com,QQProtect.exe,QQ*,qq-rdp,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
+QQ IM-remote assistance,upload_data.qq.com,qqpcmgr.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
+Quest KACE Agent (formerly Dell KACE),*.kace.com,konea.exe,KACE Agent*,,TRUE,RMM,https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function,2/9/2024
+RAdmin,user_managed,radmin.exe,famatech*,radmin,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
+RAdmin,,famitrfc.exe,radmin*,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
+RAdmin,,radmin3.exe,,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
+Rapid7,*.analytics.insight.rapid7.com,ir_agent.exe,Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
+Rapid7,*.endpoint.ingress.rapid7.com,rapid7_agent_core.exe,Rapid7 Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
+Rapid7,,rapid7_endpoint_broker.exe,,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
+rdp2tcp,user_managed,tdp2tcp.exe,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024
+rdp2tcp,,rdp2tcp.py,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024
+RDPView,user_managed,dwrcs.exe,,,TRUE,RMM,systemmanager.ru/dntu.en/rdp_view.htm - Same as Damware,2/9/2024
+rdpwrap,user_managed,RDPWInst.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
+rdpwrap,,RDPCheck.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
+rdpwrap,,RDPConf.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
+Remobo,user_managed,remobo.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
+Remobo,,remobo_client.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
+Remobo,,remobo_tracker.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
+Remote Desktop Plus,,rdp.exe,Remote Desktop Plus*,,TRUE,Utility,https://www.donkz.nl/,2/9/2024
+Remote Manipulator System,*.internetid.ru,rfusclient.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024
+Remote Manipulator System,,rutserv.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024
+Remote Utilities,*.internetid.ru,rutview.exe,Remote Utilities*,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024
+Remote Utilities,,rutserv.exe,,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024
+Remote.it,auth.api.remote.it,remote-it-installer.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
+Remote.it,api.remote.it,remote.it.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
+Remote.it,,remoteit.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
+RemoteCall,*.remotecall.com,rcengmgru.exe,RSUPPORT*,remotecall,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,*.startsupport.com,rcmgrsvc.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,rxstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,rcstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,raautoup.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,agentu.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,remotesupportplayeru.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemotePass Access,,remotepass-access.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
+RemotePass Access,,rpaccess.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
+RemotePass Access,,rpwhostscr.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
+RemotePC,*.remotepc.com,remotepcservice.exe,remotedesktop*,remotepc,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,remotepc.com,rpcsuite.exe,remotepc*,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,*.remotedesktop.com,Idrive.File-Transfer,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,,idrive.RemotePCAgent,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,,remotepchost.exe,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemoteView,*content.rview.com,remoteview.exe,RemoteView*,remoteview,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RemoteView,*.rview.com,rv.exe,RsDoctor*,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RemoteView,,rvagent.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RemoteView,,rvagtray.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RES Automation Manager,user_managed,wisshell*.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+RES Automation Manager,,wmc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+RES Automation Manager,,wmc_deployer.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+RES Automation Manager,,wmcsvc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+Royal Apps,user_managed,royalserver.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024
+Royal Apps,,royalts.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024
+RPort,user_managed,rport.exe,,,TRUE,RMM,https://kb.rport.io/using-the-remote-access,2/9/2024
+RuDesktop,*.rudesktop.ru,rd.exe,,rudesktop-remote-desktop,TRUE,RMM,https://rudesktop.ru,2/9/2024
+RuDesktop,,rudesktop*.exe,,,TRUE,RMM,https://asec.ahnlab.com/en/40263/,2/9/2024
+RustDesk,user_managed,rustdesk.exe,rustdesk*,rustdesk-remote-desktop,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024
+RustDesk,,rustdesk*.exe,,,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024
+ScreenConnect (ConnectWise),*.connectwise.com,Remote Workforce Client.exe,ConnectWise*,screenconnect,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
+ScreenConnect (ConnectWise),*.screenconnect.com,screenconnect*.exe,ScreenConnect*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
+ScreenConnect (ConnectWise),,ConnectWiseControl*.exe,CONTINUUM MANAGED*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
+ScreenConnect (ConnectWise),,connectwise*.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
+ScreenConnect (ConnectWise),,screenconnect.windowsclient.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
+ScreenConnect (ConnectWise),,screenconnect.clientservice.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
+ScreenMeet,*.screenmeet.com,ScreenMeetSupport.exe,ScreenMeet*,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024
+ScreenMeet,*.scrn.mt,ScreenMeet.Support.exe,,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024
+Seetrol,seetrol.co.kr,seetrolcenter.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolclient.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolmyservice.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolremote.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolsetting.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Senso.cloud,*.senso.cloud,SensoClient.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
+Senso.cloud,,SensoService.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
+Senso.cloud,,aadg.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
+ServerEye,*.server-eye.de,servereye*.exe,ServerEye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
+ServerEye,,ServiceProxyLocalSys.exe,Server-Eye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
+ServerEye,,,,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
+ShowMyPC,showmypc.com,showmypc*.exe,ShowMyPC*,showmypc,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
+ShowMyPC,*.showmypc.com,showmypc.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
+ShowMyPC,,SMPCSetup.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
+SimpleHelp,user_managed,simplehelpcustomer.exe,SimpleHelp*,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+SimpleHelp,,simpleservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+SimpleHelp,,simplegatewayservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+SimpleHelp,,remote access.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+Site24x7,plus*.site24x7.com,MEAgentHelper.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.eu,MonitoringAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.in,Site24x7WindowsAgentTrayIcon.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.cn,Site24x7PluginAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.net.au,,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+SkyFex,skyfex.com,Deskroll.exe,DeskRoll Remote Desktop*,,TRUE,RMM,https://skyfex.com/,2/9/2024
+SkyFex,deskroll.com,DeskRollUA.exe,,,TRUE,RMM,https://skyfex.com/,2/9/2024
+SkyFex,*.deskroll.com,,,,TRUE,RMM,https://skyfex.com/,2/9/2024
+Sophos-Remote Management System,*.sophos.com,clientmrinit.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
+Sophos-Remote Management System,*.sophosupd.com,mgntsvc.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
+Sophos-Remote Management System,*.sophosupd.net,routernt.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
+Sorillus,*.sorillus.com,Sorillus-Launcher*.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024
+Sorillus,sorillus.com,Sorillus Launcher.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024
+Splashtop Remote,splashtop.com,strwinclt.exe,Splashtop*,splashtop-remote,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,*.api.splashtop.com,Splashtop_Streamer_Windows*.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,*.relay.splashtop.com,SplashtopSOS.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,*.api.splashtop.eu,sragent.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,,srmanager.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,,srserver.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,,srservice.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+SpyAnywhere,*.spytech-web.com,sysdiag.exe,,,TRUE,RMM,https://www.spyanywhere.com/support.shtml,2/9/2024
+SunLogin,sunlogin.oray.com,OrayRemoteShell.exe,Shanghai Best Oray*,sunlogin-remote-control,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
+SunLogin,client.oray.net,OrayRemoteService.exe,Remote control service,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
+SunLogin,,sunlogin*.exe,,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
+SuperOps,superops.ai,superopsticket.exe,SuperOps*,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,*.superops.ai,superops.exe,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,serv.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,*.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,*.superopsbeta.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+Supremo,supremocontrol.com,supremo.exe,SupRemo*,supremo,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,*.supremocontrol.com,supremohelper.exe,NanoSystems*,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,* .nanosystems.it,supremoservice.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremohelper.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremo.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Syncro,app.kabuto.io ,Kabuto.App.Runner.exe,Servably*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,*.syncromsp.com,Kabuto.Service.Runner.exe,Syncro*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,*.syncroapi.com,Kabuto.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,*.kabutoservices.com,KabutoSetup.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,ld.aurelius.host,Syncro.Overmind.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,attachments.servably.com,SyncroLive.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,SyncroLive.Agent.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,Syncro.App.Runner.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,Syncro.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,Syncro.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Synergy,user_managed,,,synergy,TRUE,RMM,https://symless.com/synergy,2/26/2024
+Syspectr,atled.syspectr.com,oo-syspectr*.exe,O&O Syspectr*,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024
+Syspectr,app.syspectr.com,OOSysAgent.exe,,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024
+Tactical RMM,login.tailscale.com,tacticalrmm.exe,AmidaWare*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024
+Tactical RMM,login.tailscale.com,tacticalrmm.exe,Tactical Techs*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024
+Tailscale,*.tailscale.com,tailscale-*.exe,Tailscale*,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
+Tailscale,*.tailscale.io,tailscaled.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
+Tailscale,,tailscale-ipn.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
+Tanium,cloud.tanium.com,TaniumClient.exe,Tanium*,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,*.cloud.tanium.com,TaniumCX.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,,TaniumExecWrapper.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,,TaniumFileInfo.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,,TPowerShell.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+TeamViewer,*.teamviewer.com,teamviewer*.exe,TeamViewer*,teamviewer,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,teamviewerqs.exe,,teamviewer-remote-control,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,tv_w32.exe,,teamviewer-sharing,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,tv_w64.exe,,teamviewer-base,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,teamviewer.exe,,teamviewer-web,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeleDesktop,user_managed,pstlaunch.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
+TeleDesktop,,ptdskclient.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
+TeleDesktop,,ptdskhost.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
+TigerVNC,user_managed,tigervnc*.exe,TigerVNC*,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024
+TigerVNC,,winvnc4.exe,,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024
+TightVNC,user_managed,tvnviewer.exe,TightVNC*,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
+TightVNC,,TightVNCViewerPortable*.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
+TightVNC,,tvnserver.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
+ToDesk,todesk.com,todesk.exe,ToDesk*,,TRUE,RMM,https://www.todesk.com/,2/14/2024
+ToDesk,*.todesk.com,ToDesk_Service.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024
+ToDesk,*.todesk.com,ToDesk_Setup.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024
+TurboMeeting,user_managed,pcstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
+TurboMeeting,,turbomeeting.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
+TurboMeeting,,turbomeetingstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
+UltraViewer,* .ultraviewer.net,UltraViewer_Service.exe,UltraViewer*,ultraviewer,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraViewer,,UltraViewer_setup*,DucFabulous*,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraViewer,,UltraViewer_Desktop.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraViewer,,ultraviewer.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraVNC,user_managed,UltraVNC*.exe,,,TRUE,Remote Access,https://uvnc.com/docs/uvnc-server/49-UltraVNC-server-configuration.html,2/14/2024
+Visual Studio Dev Tunnel,global.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
+Visual Studio Dev Tunnel,*.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
+Visual Studio Dev Tunnel,*.devtunnels.ms,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
+VNC,user_managed,vncserver.exe,realvnc*,vnc,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,winvnc*.exe,,vnc-clipboard,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,vncviewer.exe,,vnc-print,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,vncserverui.exe,,vnc-encrypted,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,winwvc.exe,,vnc-filetransfer,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,winvncsc.exe,,vnc-base,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,,,vnc-http,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+WebEx (Remote Access),,,,,TRUE,Remote Access,https://help.webex.com/en-us/article/nyc3q0b/Set-Up-a-Computer-for-Remote-Access,2/14/2024
+WebRDP,user_managed,webrdp.exe,,,TRUE,RMM,github.com/Mikej81/WebRDP,2/14/2024
+Weezo,*.weezo.me,weezohttpd.exe,Peer 2 World,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
+Weezo,weezo.net,weezo.exe,Weezo*,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
+Weezo,*.weezo.net,weezo setup*.exe,,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
+Xeox,xeox.com,xeox-agent_*.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024
+Xeox,*.xeox.com,xeox_service_windows.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024
+Zabbix Agent,user_managed,zabbix_agent*.exe,Zabbix*,,TRUE,RMM,https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent,2/14/2024
+ZeroTier,zerotier.com,zerotier*.msi,ZeroTier*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
+ZeroTier,*.zerotier.com,zerotier*.exe,zero-powesrhell*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
+ZeroTier,,zero-powershell.exe,,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
+Zoho Assist,*.zoho.com,za_connect.exe,Zoho*,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.eu,zaservice.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.in,zohotray.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.com.au,ZohoMeeting.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.com.cn,Zohours.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zohoassist.com,ZohoURSService.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zohoassist.jp,ZMAgent.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zohoassist.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,downloads.zohodl.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,downloads.zohocdn.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024

dist/api/version.json

@@ -1 +1 @@
-{"version": {"name": "v4.25.0", "published_at": "2024-02-22T19:00:19Z"}}
+{"version": {"name": "v4.26.0", "published_at": "2024-03-06T22:21:51Z"}}

lookups/remote_access_software.csv

@@ -1,54 +1,569 @@
-remote_utility, description, isutility
-aweray_remote*.exe,AweRay (AweSun), TRUE
-aa_v*.exe, Ammyy Admin, TRUE
-AeroAdmin.exe, AeroAdmin, TRUE
-anydesk.exe, AnyDesk, TRUE
-AnyViewerSetup.exe, AnyViewer, TRUE
-RCClient.exe, AnyViewer, TRUE
-CService.exe, AnyViewer, TRUE
-atera_agent.exe, Atera, TRUE
-bomgar-scc.exe, BeyondTrust (Bomgar), TRUE
-bomgar-rdp.exe, BeyondTrust (Bomgar), TRUE
-screenconnect.clientservice.exe, ConnectWise Control, TRUE
-screenconnect.windowsclient.exe, ConnectWise Control, TRUE
-dwrcs.exe, Dameware, TRUE
-distant-desktop.exe, Distant Desktop, TRUE
-dwagsvc.exe, DW Service, TRUE
-g2comm.exe, GoToMyPC, TRUE
-g2fileh.exe, GoToMyPC, TRUE
-g2host.exe, GoToMyPC, TRUE
-g2mainh.exe, GoToMyPC, TRUE
-g2printh.exe, GoToMyPC, TRUE
-g2svc.exe, GoToMyPC, TRUE
-g2tray.exe, GoToMyPC, TRUE
-gopcsrv.exe, GoToMyPC, TRUE
-ROMServer.exe, LiteManager, TRUE 
-ROMFUSClient.exe, LiteManager, TRUE
-lmiignition.exe, LogMeIn, TRUE
-lmiguardiansvc.exe, LogMeIn, TRUE
-logmein*.exe, LogMeIn, TRUE
-awrem32.exe, PCAnywhere Client, TRUE
-awhost32.exe, PCAnywhere Server, TRUE
-PCMonitorManager.exe, Pulseway, TRUE
-pcmonitorsrv.exe, Pulseway, TRUE
-radmin3.exe, RAdmin, TRUE
-famitrfc.exe, RAdmin,  TRUE
-rutserv.exe, RemoteUtilities, TRUE
-smpcsetup.exe, ShowMyPC, TRUE
-showmypc*.exe, ShowMyPC, TRUE
-strwinclt.exe, Splashtop, TRUE
-supremo.exe, Supremo, TRUE
-supremohelper.exe, Supremo, TRUE
-supremosystem.exe, Supremo, TRUE
-teamviewer_desktop.exe, TeamViewer Desktop, TRUE
-teamviewer.exe, TeamViewer Service, TRUE
-teamviewer_service.exe, TeamViewer Service, TRUE
-winvnc.exe, VNC, TRUE
-vncviewer.exe, VNC, TRUE
-winvncsc.exe, VNC, TRUE
-winwvc.exe, VNC, TRUE
-Zaservice.exe, Zoho Assist, TRUE
-Zohours.exe, Zoho Assist, TRUE
-ZohoMeeting.exe, Zoho Assist, TRUE
-meshagent.exe, MeshAgent, TRUE
-tacticalrmm.exe, Tactical RMM, TRUE
+description,remote_domain,remote_utility,remote_utility_fileinfo,remote_appid,isutility,category,comment_reference,last_update
+247ithelp.com (ConnectWise),*.247ithelp.com,Remote Workforce Client.exe,,,TRUE,RMM,Simlar / replaced by ScreenConnect,2/8/2024
+Access Remote PC,,rpcgrab.exe,,,TRUE,RMM,,2/7/2024
+Access Remote PC,,rpcsetup.exe,,,TRUE,RMM,,2/7/2024
+Acronic Cyber Protect (Remotix),cloud.acronis.com,AcronisCyberProtectConnectQuickAssist*.exe,Acronis Cyber Protect Connect Quick Assist,remotix,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Acronic Cyber Protect (Remotix),agents*-cloud.acronis.com,AcronisCyberProtectConnectAgent.exe,Acronis Cyber Protect Connect Agent,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Acronic Cyber Protect (Remotix),gw.remotix.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Acronic Cyber Protect (Remotix),connect.acronis.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
+Action1,*.action1.com,action1_agent.exe,Action1*,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Action1,action1.com,action1_remote.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Action1,a1-backend-packages.s3.amazonaws.com,action1_connector.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Action1,server.action1.com,action1_update.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
+Addigy,prod.addigy.com,addigy-*.pkg,Addigy*,,TRUE,RMM,https://addigy.com/,2/27/2024
+Addigy,grtmprod.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024
+Addigy,agents.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024
+Adobe Connect,*.adobeconnect.com,ConnectAppSetup*.exe,Adobe Connect,adobe-connect,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+Adobe Connect,,ConnectShellSetup*.exe,,adobe-meeting-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+Adobe Connect,,Connect.exe,,adobe-connectnow,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+Adobe Connect,,ConnectDetector.exe,,adobe-connectnow-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
+AeroAdmin,auth*.aeroadmin.com,aeroadmin.exe,AeroAdmin*,aeroadmin,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024
+AeroAdmin,aeroadmin.com,,Aero Admin*,,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024
+AliWangWang-remote-control,wangwang.taobao.com,alitask.exe,AliWangWang*,ali-wangwang,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024
+AliWangWang-remote-control,,,,ali-wangwang-remote-control,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024
+Alpemix,*.alpemix.com,alpemix.exe,Alpemix*,alpemix,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024
+Alpemix,*.teknopars.com,,Teknopars*,,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024
+Ammyy Admin,*ammyy.com,aa_v*.exe,Ammyy*,ammyy-admin,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024
+Ammyy Admin,,AMMYY_Admin.exe,,,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024
+Any Support,*.anysupport.net,ManualLauncher.exe,AnySupport*,anysupport,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024
+Any Support,,,"Koino Co., Ltd.",,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024
+AnyDesk,net.anydesk.com,anydesk.exe,anydesk*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024
+AnyDesk,,,philandro Software*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024
+Anyplace Control,anyplace-control.com,apc_host.exe,Anyplace*,anyplace-remote-control,TRUE,RMM,http://www.anyplace-control.com/anyplace-control/help/faq.htm,2/7/2024
+AnyViewer,controlserver.anyviewer.com,AnyViewerSetup.exe,AOMEI*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
+AnyViewer,*.aomeisoftware.com,RCClient.exe,Anyviewer*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
+AnyViewer,aomeisoftware.com,RCService.exe,,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
+Apple Remote Desktop,user_managed,ARDAgent.app,,apple-remote-desktop,TRUE,RMM,https://support.apple.com/guide/remote-desktop/install-and-set-up-remote-desktop-apdf49e03a4/mac,2/24/2024
+Atera RMM,agent-api.atera.com,atera_agent.exe,Atera Networks,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
+Atera RMM,pubsub.atera.com,ateraagent.exe,AteraAgent,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
+Atera RMM,,syncrosetup.exe,,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
+Auvik,*.my.auvik.com,auvik.engine.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024
+Auvik,*.auvik.com,auvik.agent.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024
+AweRay,asapi*.aweray.net,aweray_remote*.exe,AweRay*,awesun,TRUE,RMM,https://sun.aweray.com/help,2/7/2024
+AweRay,client-api.aweray.com,AweSun.exe,AweSun*,,TRUE,RMM,https://sun.aweray.com/help,2/7/2024
+Barracuda,*.islonline.net,,Barracuda MSP,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
+Barracuda,rmm.barracudamsp.com,,Barracuda Networks,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
+Barracuda,,,LPI Level Platforms,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
+Basecamp,,,,,TRUE,RMM,basecamp.com - No specific RMM tool listed,2/7/2024
+BeamYourScreen,beamyourscreen.com,beamyourscreen.exe,BeamYourScreen*,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024
+BeamYourScreen,*.beamyourscreen.com,beamyourscreen-host.exe,,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024
+BeAnywhere,beanywhere.com,BASupConHelper.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnywhere,*.beanywhere.com,BASupSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnywhere,,BASupSrvcCnfg.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnywhere,,BASupSrvcUpdater.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupSysInf.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupAppSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupAppElev.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,TakeControl.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
+BeInSync,*.beinsync.net,Beinsync*.exe,BeInSync,beinsync,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024
+BeInSync,*.beinsync.com,,BeInSync Client GUI,,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024
+BeyondTrust (Bomgar),*.beyondtrustcloud.com,bomgar-scc-*.exe,BeyondTrust*,beyond-trust-remote-support,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),*.bomgarcloud.com,bomgar-scc.exe,Bomgar*,bomgar,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),bomgarcloud.com,bomgar-pac-*.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),,bomgar-pac.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+BeyondTrust (Bomgar),,bomgar-rdp.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
+CentraStage (Now Datto),*.rmm.datto.com,CagService.exe,Datto*,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024
+CentraStage (Now Datto),*cc.centrastage.net,AEMAgent.exe,,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024
+Centurion,centuriontech.com,ctiserv.exe,,,TRUE,RMM,https://data443.atlassian.net/servicedesk/customer/portal/20,2/7/2024
+Chrome Remote Desktop,*remotedesktop.google.com,remote_host.exe,Chrome Remote Desktop,chrome-remote-desktop,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024
+Chrome Remote Desktop,*remotedesktop-pa.googleapis.com,remoting_host.exe,,,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024
+CloudFlare Tunnel,,cloudflared.exe,,,TRUE,Remote Access,cloudflare.com/products/tunnel/,2/7/2024
+Comodo RMM,*.itsm-us1.comodo.com,itsmagent.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024
+Comodo RMM,*mdmsupport.comodo.com,rviewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024
+Connectwise Automate (LabTech),*.hostedrmm.com,ltsvc.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
+Connectwise Automate (LabTech),,ltsvcmon.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
+Connectwise Automate (LabTech),,lttray.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
+CrossLoop,*.crossloop.com,crossloopservice.exe,Crossloop*,crossloop,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
+CrossLoop,,CrossLoopConnect.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
+CrossLoop,,WinVNCStub.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
+CrossTec Remote Control,user_managed,PCIVIDEO.EXE,CrossTec,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024
+CrossTec Remote Control,,supporttool.exe,,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024
+CruzControl,,,,,TRUE,RMM,https://resources.doradosoftware.com/cruz-rmm,2/7/2024
+Dameware,user_managed,dntus*.exe,DameWare*,dameware-mini-remote,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+Dameware,,dwrcs.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,DameWare Remote Support.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,SolarWinds-Dameware-MRC*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,DameWare Mini Remote Control*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DameWare,,SolarWinds-Dameware-DRS*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
+DeskDay,deskday.ai,ultimate_*.exe,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024
+DeskDay,app.deskday.ai,,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024
+DeskNets,,,,desknets,TRUE,RMM,https://www.desknets.com/en/download.html,2/26/2024
+DeskShare,user_managed,TeamTaskManager.exe,Team Task Manager*,deskshare,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024
+DeskShare,,DSGuest.exe,DeskShare*,,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024
+DesktopNow,*.nchuser.com,desktopnow.exe,DesktopNow*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024
+DesktopNow,,,NCH Software*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024
+Distant Desktop,*.distantdesktop.com,distant-desktop.exe,Distant Software*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
+Distant Desktop,*signalserver.xyz,dd.exe,Distant Desktop*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
+Distant Desktop,,ddsystem.exe,German Gorodokuplya*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
+Domotz,*.domotz.co,domotz*.exe,Domotz*,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,*cell-1.domotz.com,domotz_bash.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,domotz.com,domotz-windows*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,,Domotz Pro Desktop App.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,,Domotz Pro Desktop App Setup*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+Domotz,,domotz.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
+DW Service,*.dwservice.net,dwagsvc.exe,DWSNET*,dws-remote-control,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
+DW Service,,dwagent.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
+DW Service,,dwagsvc.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
+Echoware,,echoserver*.exe,,echoware,TRUE,RMM,,2/7/2024
+Echoware,,echoware.dll,,,TRUE,RMM,,2/7/2024
+Electric AI (Kaseya),,,,,TRUE,RMM,https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf,2/7/2024
+EMCO Remote Console,user_managed,remoteconsole.exe,,,TRUE,RMM,,2/7/2024
+Encapto,,,,,TRUE,RMM,https://www.encapto.com - used to manage Cisco services,2/7/2024
+Ericom AccessNow,user_managed,accessserver*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
+Ericom Connect,user_managed,EricomConnectRemoteHost*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
+Ericom Connect,,ericomconnnectconfigurationtool.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
+ESET Remote Administrator,user_managed,era.exe,ESET Management*,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,einstaller.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,ezhelp*.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,eratool.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ESET Remote Administrator,,ERAAgent.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
+ezHelp,*.ezhelp.co.kr,ezhelpclientmanager.exe,Mastersoft Corp*,ezhelp,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
+ezHelp,,ezHelpManager.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
+ezHelp,,ezhelpclient.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
+FastViewer,*.fastviewer.com,fastclient.exe,Fastviewer*,fastviewer,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
+FastViewer,,fastmaster.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
+FastViewer,,FastViewer.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
+FixMe.it,*.fixme.it,FixMeit Unattended Access Setup.exe,FixMe*,techinline,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,*.techinline.net,TiExpertStandalone.exe,SetMe*,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,fixme.it,FixMeitClient*.exe,FixMe.IT Helper,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,*set.me,FixMeit Client.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,*setme.net,FixMeit Expert Setup.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,TiExpertCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,fixmeitclient.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,TiClientCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FixMe.it,,TiClientHelper*.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
+FleetDesk.io,*.fleetdeck.io,fleetdeck_agent_svc.exe,FleetDeck*,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,cognito-idp.us-west-2.amazonaws.com,fleetdeck_commander_svc.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,fleetdeck.io,fleetdeck_installer.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,,fleetdeck_agent.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+FleetDesk.io,,fleetdeck_commander_launcher.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
+Fortra,,,,,TRUE,RMM,https://www.fortra.com - No free/cloud RMM softwars listed,2/7/2024
+GatherPlace-desktop sharing,*.gatherplace.com,gp3.exe,Gatherworks*,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
+GatherPlace-desktop sharing,*.gatherplace.net,gp4.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
+GatherPlace-desktop sharing,,gp5.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
+GetScreen,*.getscreen.me,getscreen.exe,getscreen.me*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024
+GetScreen,getscreen.me,,Point B Ltd*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024
+GoToAssist,goto.com,gotoassist.exe,GoToAssist*,gotoassist,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.getgo.com,g2a*.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.fastsupport.com,GoTo Assist Opener.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.gotoassist.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,helpme.net,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.gotoassist.me,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.gotoassist.at,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GoToAssist,*.desktopstreaming.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
+GotoHTTP,gotohttp.com,gotohttp.exe,GotoHTTP*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024
+GotoHTTP,*.gotohttp.com,GotoHTTP_x64.exe,Pingbo*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024
+GoToMyPC,*.GoToMyPC.com,g2file*.exe,GoTo Opener,gotomypc,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2quick.exe,GoToOpener,gotomypc-base,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2svc.exe,,gotomypc-desktop-sharing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2tray.exe,,gotomypc-remote-control,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2svc.exe,,gotomypc-printing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2printh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2fileh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2tray.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,gopcsrv.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2host.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2comm.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+GoToMyPC,,g2mainh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
+Goverlan,user_managed,goverrmc.exe,Goverlan*,goverlan,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,govsrv*.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,GovAgentInstallHelper.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,GovAgentx64.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Goverlan,,GovReachClient.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
+Guacamole,user_managed,guacd.exe,,,TRUE,RMM,guacamole.apache.org,2/8/2024
+HelpBeam,,helpbeam*.exe,,,TRUE,RMM,https://www.helpbeam.com domain for sale in 2024,2/8/2024
+HelpU,helpu.co.kr,helpu_install.exe,helpU*,helpu,TRUE,RMM,https://helpu.co.kr/,2/8/2024
+HelpU,*.helpu.co.kr,HelpuUpdater.exe,Help Manager Program,,TRUE,RMM,https://helpu.co.kr/,2/8/2024
+HelpU,,HelpuManager.exe,,,TRUE,RMM,https://helpu.co.kr/,2/8/2024
+I'm InTouch,*.01com.com,iit.exe,I'm InTouch*,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
+I'm InTouch,,intouch.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
+I'm InTouch,,I'm InTouch Go Installer.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
+Instant Housecall,*.instanthousecall.com,hsloader.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+Instant Housecall,*.instanthousecall.net,ihcserver.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+Instant Housecall,instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+Instant Housecall,secure.instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
+IntelliAdmin Remote Control,user_managed,iadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,*.intelliadmin.com,intelliadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,,agent32.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,,agent64.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+IntelliAdmin Remote Control,,agent_setup_5.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
+Iperius Remote,*.iperiusremote.com,iperius.exe,Enter Srl*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
+Iperius Remote,*.iperius.com,iperiusremote.exe,Enter S.R.L*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
+Iperius Remote,*.iperius-rs.com,,Iperius Remote*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
+ISL Online,*.islonline.com,islalwaysonmonitor.exe,ISL Online*,isl-light,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+ISL Online,*.islonline.net,isllight.exe,ISL Light*,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+ISL Online,,isllightservice.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+ISL Online,,ISLLightClient.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
+Itarian,*.itsm-us1.comodo.com,ITSMAgent.exe,Itarian*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,mdmsupport.comodo.com,ItsmRsp.exe,RMM*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,*.cmdm.comodo.com,ITSMService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,remoteaccess.itarian.com,RDesktop.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,servicedesk.itarian.com,RHost.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,RmmService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,ComodoRemoteControl.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,RAccess.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,RViewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+Itarian,,ITarianRemoteAccessSetup.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
+ITSupport247 (ConnectWise),*.itsupport247.net,saazapsc.exe,,,TRUE,RMM,https://control.itsupport247.net/,2/8/2024
+Ivanti Remote Control,*.ivanticloud.com,IvantiRemoteControl.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
+Ivanti Remote Control,,ArcUI.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
+Ivanti Remote Control,,AgentlessRC.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
+Jump Cloud,*.api.jumpcloud.com,JumpCloud*.exe ,JumpCloud*,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024
+Jump Cloud,*.assist.jumpcloud.com,,,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024
+Jump Desktop,*.jumpdesktop.com,jumpclient.exe,,jumpdesktop,TRUE,RMM,https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect,2/9/2024
+Jump Desktop,jumpdesktop.com,jumpdesktop.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Jump Desktop,jumpto.me,jumpservice.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Jump Desktop,*.jumpto.me,jumpconnect.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Jump Desktop,,jumpupdater.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
+Kabuto,*.kabuto.io,Kabuto.App.Runner.exe,,,TRUE,RMM,https://www.repairtechsolutions.com/documentation/kabuto/,2/8/2024
+Kaseya (VSA),deploy01.kaseya.com,agentmon.exe,Kaseya*,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
+Kaseya (VSA),*managedsupport.kaseya.net,KaUpdHlp.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
+Kaseya (VSA),*.kaseya.net,KaUsrTsk.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
+KHelpDesk,*.khelpdesk.com.br,KHelpDesk.exe,KHELPDESK*,khelpdesk-remote-control,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024
+KHelpDesk,,,Ferramenta de Acesso Remoto,,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024
+KickIdler,kickidler.com,grabberEM.*msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024
+KickIdler,my.kickidler.com,grabberTT*.msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024
+LANDesk,*.ivanticloud.com,issuser.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,*.ivanti.com,landeskagentbootstrap.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,,LANDeskPortalManager.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,,ldinv32.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+LANDesk,,ldsensors.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
+Laplink Everywhere,everywhere.laplink.com,laplink.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,le.laplink.com,laplink-everywhere-setup*.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,atled.syspectr.com,laplinkeverywhere.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,,llrcservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,,serverproxyservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Everywhere,,OOSysAgent.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
+Laplink Gold,user_managed,tsircusr.exe,,,TRUE,RMM,wen.laplink.com/product/laplink-gold,2/8/2024
+Level.io,level.io,level-windows-amd64.exe,Level*,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
+Level.io,*.level.io,level.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
+Level.io,,level-remote-control-ffmpeg.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
+LiteManager,*.litemanager.ru,romfusclient.exe,Yakhnovets Denis*,litemanager,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LiteManager,*.litemanager.com,romviewer.exe,ROMServer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LiteManager,,romserver.exe,ROMViewer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LiteManager,,lmnoipserver.exe,LiteManager*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
+LogMeIn,*logmein.eu,lmiguardiansvc.exe,LogMeIn*,logmein,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,*.logmeininc.com,lmiignition.exe,RemotelyAnywhere*,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,*.logmein.com,logmein.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,,logmeinsystray.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,,logmein*.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn,,lmiignition.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
+LogMeIn rescue,*.logmeinrescue.com,support-logmeinrescue*.exe,,logmeinrescue,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
+LogMeIn rescue,*.logmeinrescue.eu,support-logmeinrescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
+LogMeIn rescue,,lmi_rescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
+Manage Engine (Desktop Central),desktopcentral.manageengine.com,dcagentservice.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),desktopcentral.manageengine.com.eu,dcagentregister.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),desktopcentral.manageengine.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),*.dms.zoho.com,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),*.dms.zoho.com.eu,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+Manage Engine (Desktop Central),*.-dms.zoho.com.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
+MeshCentral,user_managed,meshcentral*.exe,meshcentral,,TRUE,RMM,https://ylianst.github.io/MeshCentral/meshcentral/,2/8/2024
+Microsoft Quick Assist,user_managed,quickassist.exe,,ms-quick-assist,TRUE,Built-in,https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca,2/9/2024
+Microsoft RDP,,mstsc.exe,,ms-rdp,TRUE,Built-in,https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windows,2/8/2024
+Microsoft TSC,,termsrv.exe,,,TRUE,Built-in,https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/terminal-server-startup-connection-application,2/8/2024
+Mikogo,*.real-time-collaboration.com,mikogo.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+Mikogo,*.mikogo4.com,mikogo-starter.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+Mikogo,*.mikogo.com,mikogo-service.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+Mikogo,,mikogolauncher.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
+MioNet (WD Anywhere Access),,mionet.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024
+MioNet (WD Anywhere Access),,mionetmanager.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024
+mRemoteNG,user_managed,mRemoteNG.exe,,,TRUE,RMM,https://github.com/mRemoteNG/mRemoteNG,2/9/2024
+MSP360,*.cloudberrylab.com,Online Backup.exe,MSP360*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,*.msp360.com,CBBackupPlan.exe,Cloud.Ra*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,*.mspbackups.com,Cloud.Backup.Scheduler.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,Cloud.Backup.RM.Service.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,cbb.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaService.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaSd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaCmd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,CloudRaUtilities.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,Remote Desktop.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MSP360,,Connect.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
+MyGreenPC,*mygreenpc.com,mygreenpc.exe,,mygreenpc,TRUE,RMM,http://www.mygreenpc.com/,2/26/2024
+MyIVO,,myivomgr.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024
+MyIVO,,myivomanager.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024
+N-Able Advanced Monitoring Agent,*remote.management,Agent_*_RW.exe,N-Able*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.logicnow.com,BASEClient.exe,Remote Monitoring*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*systemmonitor.us,BASupApp.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*systemmonitor.eu.com,BASupSrvc.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*system-monitor.com,BASupSrvcCnfg.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,systemmonitor.us.cdn.cloudflare.net,BASupTSHelper.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*cloudbackup.management,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*systemmonitor.co.uk,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.n-able.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.beanywhere.com ,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+N-Able Advanced Monitoring Agent,*.swi-tc.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
+NateOn-desktop sharing,*.nate.com,nateon*.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
+NateOn-desktop sharing,,nateon.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
+NateOn-desktop sharing,,nateonmain.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
+Naverisk,user_managed,AgentSetup-*.exe,naverisk*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024
+Naverisk,,,NavMK1 Limited*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024
+Netop Remote Control (Impero Connect),*.connect.backdrop.cloud,nhostsvc.exe,Impero Solutions*,netop-remote-control,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),*.netop.com,nhstw32.exe,Impero Connect*,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,ngstw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,Netop Ondemand.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,nldrw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,rmserverconsolemediator.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,ImperoInit.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,Connect.Backdrop.cloud*.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
+Netop Remote Control (Impero Connect),,ImperoClientSVC.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/8/2024
+Netreo,charon.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
+Netreo,activation.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
+Netreo,*.api.netreo.com,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
+NetSupport Manager,*.netsupportmanager.com,pcictlui.exe,netsupport,netsupport-manager,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
+NetSupport Manager,,pcicfgui.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
+NetSupport Manager,,client32.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
+Neturo,neturo.uplus.co.kr,neturo*.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024
+Neturo,,ntrntservice.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024
+Netviewer (GoToMeet),,nvClient.exe,Algorius*,netviewer,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024
+Netviewer (GoToMeet),,netviewer.exe,,,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024
+ngrok,user_managed,ngrok.exe,,,TRUE,Developer Utility,https://ngrok.com/docs/guides/running-behind-firewalls/,2/9/2024
+NinjaRMM,*.ninjaone.com,ninjarmmagent.exe,NinjaRMM*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024
+NinjaRMM,*.ninjarmm.com,NinjaRMMAgenPatcher.exe,Ninja MSP*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024
+NoMachine,user_managed,nomachine*.exe,NoMachine*,nomachine,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
+NoMachine,,nxservice*.ese,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
+NoMachine,,nxd.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
+NTR Remote,*.ntrsupport.com,NTRsupportPro_EN.exe,Net Transmit & Receive SL,ntr-remote,TRUE,RMM,DOA as of 2024,2/26/2024
+OCS inventory,user_managed,ocsinventory.exe,Ocs Inventory*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024
+OCS inventory,,ocsservice.exe,OcsPackager*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024
+OptiTune,*.optitune.us,OTService.exe,Bravura Software*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024
+OptiTune,*.opti-tune.com,OTPowerShell.exe,OptiTune*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024
+Pandora RC (eHorus),portal.ehorus.com,ehorus standalone.exe,eHorus*,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
+Pandora RC (eHorus),,ehorus_agent.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
+Panorama9,trusted.panorama9.com,p9agent*.exe,Panorama9*,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024
+Panorama9,changes.panorama9.com,,,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024
+Parallels Access,*.parallels.com,prl_deskctl_agent.exe,Parallels Access*,parallels-access,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+Parallels Access,,prl_deskctl_wizard.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+Parallels Access,,prl_pm_service.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+Parallels Access,,parallelsaccess-*.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
+pcAnywhere,user_managed,awhost32.exe,,pcanywhere,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
+pcAnywhere,,pcaquickconnect.exe,,pcanywhere-remote-control,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
+pcAnywhere,,winaw32.exe,,pcanywhere-base,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
+Pcnow,,mwcliun.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
+Pcnow,,pcnmgr.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
+Pcnow,,webexpcnow.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
+Pcvisit,*.pcvisit.de,pcvisit.exe,pcvisit*,pcvisit,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+Pcvisit,,pcvisit_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+Pcvisit,,pcvisit-easysupport.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+Pcvisit,,pcvisit_service_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
+PDQ Connect,app.pdq.com,pdq-connect*.exe,PDQ.com*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024
+PDQ Connect,cfcdn.pdq.com,,PDQConnectAgent*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024
+Pilixo,*.pilixo.com,Pilixo_Installer*.exe,Pilixo*,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls,2/9/2024
+Pilixo,pilixo.com,rdp.exe,,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141862-pilixo-anti-virus-and-anti-malware-exclusion-recommendations,2/9/2024
+Pilixo,download.pilixo.com,,,,TRUE,RMM,pilixo domain DOA as of 2024,2/9/2024
+Pocket Cloud (Wyse),,pocketcloud*.exe,PocketCloud*,pocket-cloud,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024
+Pocket Cloud (Wyse),,pocketcloudservice.exe,,,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024
+Pocket Controller (Soti Xsight),*soti.net,pocketcontroller.exe,Pocket Controller*,pocket-controller,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
+Pocket Controller (Soti Xsight),,wysebrowser.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
+Pocket Controller (Soti Xsight),,XSightService.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
+PSEXEC,user_managed,psexec.exe,Sysinternals PsExec,psexec,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024
+PSEXEC,,psexecsvc.exe,PsExec*,,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024
+PSEXEC (Clone),user_managed,paexec.exe,Power Admin*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024
+PSEXEC (Clone),,PAExec-*.exe,PAExec*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024
+PSEXEC (Clone),,csexec.exe ,,,TRUE,Remote Access,https://github.com/malcomvetter/CSExec,2/9/2024
+PSEXEC (Clone),,remcom.exe,Remote System Deployment*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024
+PSEXEC (Clone),,remcomsvc.exe,Remote Command Executor*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024
+PSEXEC (Clone),,xcmd.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024
+PSEXEC (Clone),,xcmdsvc.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024
+PulseWay,user_managed,pcmonitorsrv.exe,Pulseway*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024
+Pulseway,,PCMonitorManager.exe,MMSoft Design*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024
+QQ IM-remote assistance,*.mdt.qq.com,qq.exe,Tencent*,qq,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
+QQ IM-remote assistance,*.desktop.qq.com,QQProtect.exe,QQ*,qq-rdp,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
+QQ IM-remote assistance,upload_data.qq.com,qqpcmgr.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
+Quest KACE Agent (formerly Dell KACE),*.kace.com,konea.exe,KACE Agent*,,TRUE,RMM,https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function,2/9/2024
+RAdmin,user_managed,radmin.exe,famatech*,radmin,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
+RAdmin,,famitrfc.exe,radmin*,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
+RAdmin,,radmin3.exe,,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
+Rapid7,*.analytics.insight.rapid7.com,ir_agent.exe,Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
+Rapid7,*.endpoint.ingress.rapid7.com,rapid7_agent_core.exe,Rapid7 Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
+Rapid7,,rapid7_endpoint_broker.exe,,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
+rdp2tcp,user_managed,tdp2tcp.exe,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024
+rdp2tcp,,rdp2tcp.py,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024
+RDPView,user_managed,dwrcs.exe,,,TRUE,RMM,systemmanager.ru/dntu.en/rdp_view.htm - Same as Damware,2/9/2024
+rdpwrap,user_managed,RDPWInst.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
+rdpwrap,,RDPCheck.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
+rdpwrap,,RDPConf.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
+Remobo,user_managed,remobo.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
+Remobo,,remobo_client.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
+Remobo,,remobo_tracker.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
+Remote Desktop Plus,,rdp.exe,Remote Desktop Plus*,,TRUE,Utility,https://www.donkz.nl/,2/9/2024
+Remote Manipulator System,*.internetid.ru,rfusclient.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024
+Remote Manipulator System,,rutserv.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024
+Remote Utilities,*.internetid.ru,rutview.exe,Remote Utilities*,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024
+Remote Utilities,,rutserv.exe,,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024
+Remote.it,auth.api.remote.it,remote-it-installer.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
+Remote.it,api.remote.it,remote.it.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
+Remote.it,,remoteit.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
+RemoteCall,*.remotecall.com,rcengmgru.exe,RSUPPORT*,remotecall,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,*.startsupport.com,rcmgrsvc.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,rxstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,rcstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,raautoup.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,agentu.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemoteCall,,remotesupportplayeru.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
+RemotePass Access,,remotepass-access.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
+RemotePass Access,,rpaccess.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
+RemotePass Access,,rpwhostscr.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
+RemotePC,*.remotepc.com,remotepcservice.exe,remotedesktop*,remotepc,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,remotepc.com,rpcsuite.exe,remotepc*,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,*.remotedesktop.com,Idrive.File-Transfer,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,,idrive.RemotePCAgent,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemotePC,,remotepchost.exe,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
+RemoteView,*content.rview.com,remoteview.exe,RemoteView*,remoteview,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RemoteView,*.rview.com,rv.exe,RsDoctor*,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RemoteView,,rvagent.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RemoteView,,rvagtray.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
+RES Automation Manager,user_managed,wisshell*.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+RES Automation Manager,,wmc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+RES Automation Manager,,wmc_deployer.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+RES Automation Manager,,wmcsvc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
+Royal Apps,user_managed,royalserver.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024
+Royal Apps,,royalts.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024
+RPort,user_managed,rport.exe,,,TRUE,RMM,https://kb.rport.io/using-the-remote-access,2/9/2024
+RuDesktop,*.rudesktop.ru,rd.exe,,rudesktop-remote-desktop,TRUE,RMM,https://rudesktop.ru,2/9/2024
+RuDesktop,,rudesktop*.exe,,,TRUE,RMM,https://asec.ahnlab.com/en/40263/,2/9/2024
+RustDesk,user_managed,rustdesk.exe,rustdesk*,rustdesk-remote-desktop,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024
+RustDesk,,rustdesk*.exe,,,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024
+ScreenConnect (ConnectWise),*.connectwise.com,Remote Workforce Client.exe,ConnectWise*,screenconnect,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
+ScreenConnect (ConnectWise),*.screenconnect.com,screenconnect*.exe,ScreenConnect*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
+ScreenConnect (ConnectWise),,ConnectWiseControl*.exe,CONTINUUM MANAGED*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
+ScreenConnect (ConnectWise),,connectwise*.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
+ScreenConnect (ConnectWise),,screenconnect.windowsclient.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
+ScreenConnect (ConnectWise),,screenconnect.clientservice.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
+ScreenMeet,*.screenmeet.com,ScreenMeetSupport.exe,ScreenMeet*,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024
+ScreenMeet,*.scrn.mt,ScreenMeet.Support.exe,,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024
+Seetrol,seetrol.co.kr,seetrolcenter.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolclient.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolmyservice.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolremote.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Seetrol,,seetrolsetting.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
+Senso.cloud,*.senso.cloud,SensoClient.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
+Senso.cloud,,SensoService.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
+Senso.cloud,,aadg.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
+ServerEye,*.server-eye.de,servereye*.exe,ServerEye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
+ServerEye,,ServiceProxyLocalSys.exe,Server-Eye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
+ServerEye,,,,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
+ShowMyPC,showmypc.com,showmypc*.exe,ShowMyPC*,showmypc,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
+ShowMyPC,*.showmypc.com,showmypc.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
+ShowMyPC,,SMPCSetup.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
+SimpleHelp,user_managed,simplehelpcustomer.exe,SimpleHelp*,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+SimpleHelp,,simpleservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+SimpleHelp,,simplegatewayservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+SimpleHelp,,remote access.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
+Site24x7,plus*.site24x7.com,MEAgentHelper.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.eu,MonitoringAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.in,Site24x7WindowsAgentTrayIcon.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.cn,Site24x7PluginAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+Site24x7,plus*.site24x7.net.au,,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
+SkyFex,skyfex.com,Deskroll.exe,DeskRoll Remote Desktop*,,TRUE,RMM,https://skyfex.com/,2/9/2024
+SkyFex,deskroll.com,DeskRollUA.exe,,,TRUE,RMM,https://skyfex.com/,2/9/2024
+SkyFex,*.deskroll.com,,,,TRUE,RMM,https://skyfex.com/,2/9/2024
+Sophos-Remote Management System,*.sophos.com,clientmrinit.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
+Sophos-Remote Management System,*.sophosupd.com,mgntsvc.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
+Sophos-Remote Management System,*.sophosupd.net,routernt.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
+Sorillus,*.sorillus.com,Sorillus-Launcher*.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024
+Sorillus,sorillus.com,Sorillus Launcher.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024
+Splashtop Remote,splashtop.com,strwinclt.exe,Splashtop*,splashtop-remote,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,*.api.splashtop.com,Splashtop_Streamer_Windows*.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,*.relay.splashtop.com,SplashtopSOS.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,*.api.splashtop.eu,sragent.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,,srmanager.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,,srserver.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+Splashtop Remote,,srservice.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
+SpyAnywhere,*.spytech-web.com,sysdiag.exe,,,TRUE,RMM,https://www.spyanywhere.com/support.shtml,2/9/2024
+SunLogin,sunlogin.oray.com,OrayRemoteShell.exe,Shanghai Best Oray*,sunlogin-remote-control,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
+SunLogin,client.oray.net,OrayRemoteService.exe,Remote control service,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
+SunLogin,,sunlogin*.exe,,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
+SuperOps,superops.ai,superopsticket.exe,SuperOps*,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,*.superops.ai,superops.exe,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,serv.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,*.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+SuperOps,*.superopsbeta.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
+Supremo,supremocontrol.com,supremo.exe,SupRemo*,supremo,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,*.supremocontrol.com,supremohelper.exe,NanoSystems*,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,* .nanosystems.it,supremoservice.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremohelper.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremo.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
+Syncro,app.kabuto.io ,Kabuto.App.Runner.exe,Servably*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,*.syncromsp.com,Kabuto.Service.Runner.exe,Syncro*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,*.syncroapi.com,Kabuto.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,*.kabutoservices.com,KabutoSetup.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,ld.aurelius.host,Syncro.Overmind.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,attachments.servably.com,SyncroLive.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,SyncroLive.Agent.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,Syncro.App.Runner.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,Syncro.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Syncro,,Syncro.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
+Synergy,user_managed,,,synergy,TRUE,RMM,https://symless.com/synergy,2/26/2024
+Syspectr,atled.syspectr.com,oo-syspectr*.exe,O&O Syspectr*,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024
+Syspectr,app.syspectr.com,OOSysAgent.exe,,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024
+Tactical RMM,login.tailscale.com,tacticalrmm.exe,AmidaWare*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024
+Tactical RMM,login.tailscale.com,tacticalrmm.exe,Tactical Techs*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024
+Tailscale,*.tailscale.com,tailscale-*.exe,Tailscale*,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
+Tailscale,*.tailscale.io,tailscaled.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
+Tailscale,,tailscale-ipn.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
+Tanium,cloud.tanium.com,TaniumClient.exe,Tanium*,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,*.cloud.tanium.com,TaniumCX.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,,TaniumExecWrapper.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,,TaniumFileInfo.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+Tanium,,TPowerShell.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
+TeamViewer,*.teamviewer.com,teamviewer*.exe,TeamViewer*,teamviewer,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,teamviewerqs.exe,,teamviewer-remote-control,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,tv_w32.exe,,teamviewer-sharing,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,tv_w64.exe,,teamviewer-base,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeamViewer,,teamviewer.exe,,teamviewer-web,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
+TeleDesktop,user_managed,pstlaunch.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
+TeleDesktop,,ptdskclient.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
+TeleDesktop,,ptdskhost.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
+TigerVNC,user_managed,tigervnc*.exe,TigerVNC*,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024
+TigerVNC,,winvnc4.exe,,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024
+TightVNC,user_managed,tvnviewer.exe,TightVNC*,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
+TightVNC,,TightVNCViewerPortable*.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
+TightVNC,,tvnserver.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
+ToDesk,todesk.com,todesk.exe,ToDesk*,,TRUE,RMM,https://www.todesk.com/,2/14/2024
+ToDesk,*.todesk.com,ToDesk_Service.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024
+ToDesk,*.todesk.com,ToDesk_Setup.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024
+TurboMeeting,user_managed,pcstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
+TurboMeeting,,turbomeeting.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
+TurboMeeting,,turbomeetingstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
+UltraViewer,* .ultraviewer.net,UltraViewer_Service.exe,UltraViewer*,ultraviewer,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraViewer,,UltraViewer_setup*,DucFabulous*,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraViewer,,UltraViewer_Desktop.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraViewer,,ultraviewer.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
+UltraVNC,user_managed,UltraVNC*.exe,,,TRUE,Remote Access,https://uvnc.com/docs/uvnc-server/49-UltraVNC-server-configuration.html,2/14/2024
+Visual Studio Dev Tunnel,global.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
+Visual Studio Dev Tunnel,*.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
+Visual Studio Dev Tunnel,*.devtunnels.ms,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
+VNC,user_managed,vncserver.exe,realvnc*,vnc,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,winvnc*.exe,,vnc-clipboard,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,vncviewer.exe,,vnc-print,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,vncserverui.exe,,vnc-encrypted,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,winwvc.exe,,vnc-filetransfer,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,winvncsc.exe,,vnc-base,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+VNC,,,,vnc-http,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
+WebEx (Remote Access),,,,,TRUE,Remote Access,https://help.webex.com/en-us/article/nyc3q0b/Set-Up-a-Computer-for-Remote-Access,2/14/2024
+WebRDP,user_managed,webrdp.exe,,,TRUE,RMM,github.com/Mikej81/WebRDP,2/14/2024
+Weezo,*.weezo.me,weezohttpd.exe,Peer 2 World,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
+Weezo,weezo.net,weezo.exe,Weezo*,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
+Weezo,*.weezo.net,weezo setup*.exe,,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
+Xeox,xeox.com,xeox-agent_*.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024
+Xeox,*.xeox.com,xeox_service_windows.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024
+Zabbix Agent,user_managed,zabbix_agent*.exe,Zabbix*,,TRUE,RMM,https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent,2/14/2024
+ZeroTier,zerotier.com,zerotier*.msi,ZeroTier*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
+ZeroTier,*.zerotier.com,zerotier*.exe,zero-powesrhell*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
+ZeroTier,,zero-powershell.exe,,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
+Zoho Assist,*.zoho.com,za_connect.exe,Zoho*,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.eu,zaservice.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.in,zohotray.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.com.au,ZohoMeeting.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zoho.com.cn,Zohours.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zohoassist.com,ZohoURSService.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zohoassist.jp,ZMAgent.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,*.zohoassist.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,downloads.zohodl.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,downloads.zohocdn.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
+Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024

lookups/remote_access_software.yml

@@ -2,6 +2,7 @@ description: A list of Remote Access Software
 filename: remote_access_software.csv
 name: remote_access_software
 default_match: 'false'
-match_type: WILDCARD(remote_software)
+match_type: WILDCARD(remote_utility),WILDCARD(remote_domain),WILDCARD(remote_utility_fileinfo)
 min_matches: 1
+max_matches: 1
 case_sensitive_match: 'false'

macros/nginx_access_logs.yml

@@ -0,0 +1,3 @@
+definition: (sourcetype="nginx:plus:kv" OR sourcetype="nginx:plus:access")
+description: This is the base macro for Nginx sourcetypes
+name: nginx_access_logs

macros/suricata.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=suricata
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: suricata

pipeline/.app_inspect.yml

@@ -1,7 +1,6 @@
 app_inspect:
   stage: app_inspect
   needs:
-  - validate_escu
   - generate_escu
   artifacts:
     when: always
@@ -9,16 +8,46 @@ app_inspect:
       - artifacts/*
     expire_in: 60 days  
   before_script:
+    - 'NEW_VERSION=$(echo $CI_COMMIT_TAG | sed "s/^v//")'
+    - 'echo "Updating contentctl.yml version: $NEW_VERSION"'
+    - 'sed -i "s/version: [0-9]*\.[0-9]*\.[0-9]*/version: $NEW_VERSION/" contentctl.yml'
     - pip3 install poetry
     - git submodule update --init contentctl
     - cd contentctl
     - git checkout main
     - poetry install
   script:
-    - poetry run contentctl -p ../ build --appinspect_api_username $APPINSPECT_USERNAME --appinspect_api_password $APPINSPECT_PASSWORD
+    - poetry run contentctl -p ../ build  --appinspect_api_username $APPINSPECT_USERNAME --appinspect_api_password $APPINSPECT_PASSWORD
   after_script:
     - mkdir -p artifacts/app_inspect_report
-    - cp -r dist/*.{json,html,log} artifacts/app_inspect_report
+    - cp -r dist/*.{json,html} artifacts/app_inspect_report
+    - cp -r dist/*.tar.gz artifacts/
+
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]$/'
       when: on_success
+
+upload_to_splunkbase:
+  stage: app_inspect
+  needs:
+    - app_inspect
+  artifacts:
+    when: always
+    paths:
+      - artifacts/*
+    expire_in: 60 days
+  script:
+    - echo "Start upload_to_splunkbase"
+    - chmod +x pipeline/upload_to_splunkbase.sh
+    - HTTP_STATUS=$(./pipeline/upload_to_splunkbase.sh)
+    - |
+      if [ "$HTTP_STATUS" -eq 200 ]; then
+        echo "Upload to Splunkbase successful, pipeline will pass."
+      else
+        echo "Upload failed with status $HTTP_STATUS, failing the pipeline."
+        exit 1
+      fi
+    - echo "Finished uploading to splunkbase"
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]$/'
+      when: on_success

pipeline/.generate.yml

@@ -48,9 +48,9 @@ generate_ba:
       else
         poetry run contentctl -p ../ build -t ssa
       fi
-    - cd ..
-    - mkdir -p artifacts/ssa
-    - cp -r dist/ssa/* artifacts/ssa
+    - cd ..  
+    - mkdir artifacts
+    - tar -czf artifacts/SSA-Content-latest.tar.gz -C dist/ssa .
 
 generate_api:
   stage: generate
@@ -76,4 +76,4 @@ generate_api:
       fi
     - cd ..
     - mkdir -p artifacts/api
-    - cp -r dist/api/* artifacts/api
+    - cp -r dist/api/* artifacts/api

pipeline/.post.yml

@@ -15,7 +15,7 @@ include:
 # download and configure extracto
 .setup_extracto: &setup_extracto
   - |
-    curl -u $ARTIFACTORY_AUTHORIZATION -L https://repo.splunkdev.net/artifactory/generic/extracto/1.0.60/linux_amd64/extracto -o extracto
+    curl -u $ARTIFACTORY_AUTHORIZATION -L $ARTIFACTORY_BASE_URL/generic/extracto/$EXTRACTO_VERSION/linux_amd64/extracto -o extracto
     chmod +x ./extracto
     cat > extracto_config.yml << EOF
     enrichers:
@@ -27,6 +27,7 @@ include:
     version: $ESCU_VERSION
 
     EOF
+  - export EXTRACTO_SPLUNK_INDEX="gitlab_extracto"
   - export EXTRACTO_CONFIG=./extracto_config.yml
 
 # send pipeline metadata to extracto

pipeline/.release.yml

@@ -164,6 +164,10 @@ update_gitlab_dist:
     - git remote set-url origin https://PUSH_DIST_VIA_CI:$PUSH_DIST_VIA_CI@cd.splunkdev.com/threat-research/security_content.git
     - git fetch --all
     - git checkout develop
+    - 'echo "Current CI_COMMIT_TAG: $CI_COMMIT_TAG"'
+    - 'NEW_VERSION=$(echo $CI_COMMIT_TAG | sed "s/^v//")'
+    - 'echo "Updating contentctl.yml version: $NEW_VERSION"'
+    - 'sed -i "s/version: [0-9]*\.[0-9]*\.[0-9]*/version: $NEW_VERSION/" contentctl.yml'
     - git add dist/api/*
     - git add dist/DA-ESS-ContentUpdate/*
     - git add dist/ssa/*
@@ -210,4 +214,4 @@ github_push_develop:
     # - 'curl -X POST -H "Authorization: token $CREATE_GH_RELEASE_PR" -H "Accept: application/vnd.github.v3+json" -d "{\"title\":\"Release $CI_COMMIT_TAG\", \"body\":\"This PR contains content for ESCU - $CI_COMMIT_TAG\", \"head\":\"develop\", \"base\":\"gitlab_release_$CI_COMMIT_TAG\"}" https://api.github.com/repos/splunk/security_content/pulls'
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]$/'
-      when: on_success
+      when: on_success

pipeline/upload_to_splunkbase.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Check if all required variables are set
+
+FILE_PATH="/builds/threat-research/security_content/artifacts/DA-ESS-ContentUpdate-latest.tar.gz"
+FILE_NAME="DA-ESS-ContentUpdate-latest.tar.gz" 
+SPLUNKBASE_USERNAME=$SPLUNKBASE_USERNAME
+SPLUNKBASE_PASSWORD=$SPLUNKBASE_PASSWORD
+
+if [ -z "$FILE_PATH" ] || [ -z "$FILE_NAME" ] || [ -z "$SPLUNKBASE_USERNAME" ] || [ -z "$SPLUNKBASE_PASSWORD" ]; then
+  echo "One or more required variables are undefined."
+  exit 1
+fi
+
+curl -u "${SPLUNKBASE_USERNAME}:${SPLUNKBASE_PASSWORD}" --request POST https://splunkbase.splunk.com/api/v1/app/3449/new_release/ \
+     -F "files[]=@${FILE_PATH}" \
+     -F "filename=${FILE_NAME}" \
+     -F "cim_versions=5.x,4.x" \
+     -F "splunk_versions=9.2,9.1,9.0,8.2,8.1,8.0,7.3" \
+     -F "visibility=false" \
+     -o /dev/null -s -w "%{http_code}"

playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.json

@@ -1,380 +1,405 @@
 {
-    "blockly": false,
-    "blockly_xml": "<xml></xml>",
-    "category": "Message Identifier Activity Analysis",
-    "coa": {
-        "data": {
-            "description": "Accepts an internet message id, and asks Gmail for a list of mailboxes to search, and then searches each one to look for records that have a matching internet message id.  It then produces a normalized output and summary table.\n\nThis may not work in the intended fashion if your organization has more than 500 mailboxes.\n\nRef: D3-IAA: https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis/",
-            "edges": [
-                {
-                    "conditions": [
-                        {
-                            "index": 0
-                        }
-                    ],
-                    "id": "port_3_to_port_4",
-                    "sourceNode": "3",
-                    "sourcePort": "3_out",
-                    "targetNode": "4",
-                    "targetPort": "4_in"
-                },
-                {
-                    "id": "port_4_to_port_5",
-                    "sourceNode": "4",
-                    "sourcePort": "4_out",
-                    "targetNode": "5",
-                    "targetPort": "5_in"
-                },
-                {
-                    "id": "port_6_to_port_7",
-                    "sourceNode": "6",
-                    "sourcePort": "6_out",
-                    "targetNode": "7",
-                    "targetPort": "7_in"
-                },
-                {
-                    "id": "port_7_to_port_1",
-                    "sourceNode": "7",
-                    "sourcePort": "7_out",
-                    "targetNode": "1",
-                    "targetPort": "1_in"
-                },
-                {
-                    "id": "port_5_to_port_9",
-                    "sourceNode": "5",
-                    "sourcePort": "5_out",
-                    "targetNode": "9",
-                    "targetPort": "9_in"
-                },
-                {
-                    "id": "port_0_to_port_3",
-                    "sourceNode": "0",
-                    "sourcePort": "0_out",
-                    "targetNode": "3",
-                    "targetPort": "3_in"
-                },
-                {
-                    "conditions": [
-                        {
-                            "index": 0
-                        }
-                    ],
-                    "id": "port_9_to_port_6",
-                    "sourceNode": "9",
-                    "sourcePort": "9_out",
-                    "targetNode": "6",
-                    "targetPort": "6_in"
-                }
-            ],
-            "hash": "c253dd1339538806313a6f387f6df7a39d537dff",
-            "nodes": {
-                "0": {
-                    "data": {
-                        "advanced": {
-                            "join": []
-                        },
-                        "functionName": "on_start",
-                        "id": "0",
-                        "type": "start"
-                    },
-                    "errors": {},
-                    "id": "0",
-                    "type": "start",
-                    "warnings": {},
-                    "x": 19.999999999999986,
-                    "y": -1.2789769243681803e-13
-                },
-                "1": {
-                    "data": {
-                        "advanced": {
-                            "join": []
-                        },
-                        "functionName": "on_finish",
-                        "id": "1",
-                        "type": "end"
-                    },
-                    "errors": {},
-                    "id": "1",
-                    "type": "end",
-                    "warnings": {},
-                    "x": 19.999999999999986,
-                    "y": 1220
-                },
-                "3": {
-                    "data": {
-                        "advanced": {
-                            "customName": "artifact filter",
-                            "customNameId": 0,
-                            "delimiter": ",",
-                            "delimiter_enabled": true,
-                            "join": [],
-                            "note": "Ensure we have an input"
-                        },
-                        "conditions": [
-                            {
-                                "comparisons": [
-                                    {
-                                        "conditionIndex": 0,
-                                        "op": "!=",
-                                        "param": "playbook_input:message_id",
-                                        "value": "None"
-                                    }
-                                ],
-                                "conditionIndex": 0,
-                                "customName": "Input Valid",
-                                "logic": "and"
-                            }
-                        ],
-                        "functionId": 1,
-                        "functionName": "artifact_filter",
-                        "id": "3",
-                        "type": "filter"
-                    },
-                    "errors": {},
-                    "id": "3",
-                    "type": "filter",
-                    "warnings": {},
-                    "x": 60,
-                    "y": 148
-                },
-                "4": {
-                    "data": {
-                        "action": "list users",
-                        "actionType": "investigate",
-                        "advanced": {
-                            "customName": "get mailboxes",
-                            "customNameId": 0,
-                            "description": "Required step in order to search \"All\" of a Gsuite organization. This receives a list of mailboxes that are passed to the next action.",
-                            "join": [],
-                            "note": "Gets a list of mailboxes from GMail to search"
-                        },
-                        "connector": "G Suite for GMail",
-                        "connectorConfigs": [
-                            "g_suite_for_gmail"
-                        ],
-                        "connectorId": "9c73f233-2c4a-406a-855e-41d8d2497d0e",
-                        "connectorVersion": "v1",
-                        "functionId": 1,
-                        "functionName": "get_mailboxes",
-                        "id": "4",
-                        "parameters": {
-                            "max_items": "500",
-                            "page_token": ""
-                        },
-                        "requiredParameters": [],
-                        "type": "action"
-                    },
-                    "errors": {},
-                    "id": "4",
-                    "type": "action",
-                    "warnings": {},
-                    "x": 0,
-                    "y": 328
-                },
-                "5": {
-                    "data": {
-                        "action": "run query",
-                        "actionType": "investigate",
-                        "advanced": {
-                            "customName": "search mailboxes",
-                            "customNameId": 0,
-                            "join": [],
-                            "note": "Searches mailboxes returned by the previous action for messages with an internet message ID matching the input"
-                        },
-                        "connector": "G Suite for GMail",
-                        "connectorConfigs": [
-                            "g_suite_for_gmail"
-                        ],
-                        "connectorId": "9c73f233-2c4a-406a-855e-41d8d2497d0e",
-                        "connectorVersion": "v1",
-                        "functionId": 1,
-                        "functionName": "search_mailboxes",
-                        "id": "5",
-                        "parameters": {
-                            "email": "get_mailboxes:action_result.data.*.emails.*.address",
-                            "internet_message_id": "filtered-data:artifact_filter:condition_1:playbook_input:message_id",
-                            "label": "Inbox",
-                            "max_results": 100,
-                            "query": ""
-                        },
-                        "requiredParameters": [
-                            {
-                                "data_type": "string",
-                                "field": "email"
-                            },
-                            {
-                                "data_type": "string",
-                                "default": "Inbox",
-                                "field": "label"
-                            },
-                            {
-                                "data_type": "numeric",
-                                "default": 100,
-                                "field": "max_results"
-                            }
-                        ],
-                        "type": "action"
-                    },
-                    "errors": {},
-                    "id": "5",
-                    "type": "action",
-                    "warnings": {},
-                    "x": 0,
-                    "y": 506
-                },
-                "6": {
-                    "data": {
-                        "advanced": {
-                            "customName": "format message report",
-                            "customNameId": 0,
-                            "join": [],
-                            "note": "Format the markdown table summary of this playbook execution"
-                        },
-                        "functionId": 1,
-                        "functionName": "format_message_report",
-                        "id": "6",
-                        "parameters": [
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.delivered_to",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.to",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.from"
-                        ],
-                        "template": "SOAR searched for occurrences of `{0}` within your environment using GSuite for GMail. The table below shows a summary of the information gathered.\n\n| Recipient | Addressed To | Subject | Sender |\n| --- | --- | --- | --- |\n%%\n| {1} | {2} | {3} | {4} |\n%%\n",
-                        "type": "format"
-                    },
-                    "errors": {},
-                    "id": "6",
-                    "type": "format",
-                    "userCode": "    \n    \n",
-                    "warnings": {},
-                    "x": 0,
-                    "y": 864
-                },
-                "7": {
-                    "data": {
-                        "advanced": {
-                            "customName": "build message output",
-                            "customNameId": 0,
-                            "description": "Logic regarding observable construction goes here",
-                            "join": [],
-                            "note": "Format the observable output object produced by this playbook"
-                        },
-                        "functionId": 1,
-                        "functionName": "build_message_output",
-                        "id": "7",
-                        "inputParameters": [
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.delivered_to",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.to",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject",
-                            "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.from"
-                        ],
-                        "outputVariables": [
-                            "observable_array"
-                        ],
-                        "type": "code"
-                    },
-                    "errors": {},
-                    "id": "7",
-                    "type": "code",
-                    "userCode": "\n    # Variable renaming for convenince\n    messageID = filtered_result_0_parameter_internet_message_id\n    recipients = filtered_result_0_data___delivered_to\n    addressees = filtered_result_0_data___to\n    subjects = filtered_result_0_data___subject\n    senders = filtered_result_0_data___from\n    \n    build_message_output__observable_array = []\n    recordList = []\n    \n    for message_id in messageID:\n    \n        # construct iterables for records\n        for recipient, addressee, subject, sender in zip(recipients, addressees, subjects, senders):\n            record = {\n                \"recipient\": recipient,\n                \"addressee\": addressee,\n                \"subject\": subject,\n                \"sender\": sender\n            }\n            recordList.append(record)\n        \n        # Create observable body\n        observable = {\n            \"value\": message_id,\n            \"type\": \"internet message ID\",\n            \"count\": len(recordList),\n            \"source\": \"GSuite for GMail\",\n            \"message_identifier_activity\": recordList\n        }\n    \n        build_message_output__observable_array.append(observable)\n    \n\n",
-                    "warnings": {},
-                    "x": 0,
-                    "y": 1040
-                },
-                "9": {
-                    "data": {
-                        "advanced": {
-                            "customName": "results filter",
-                            "customNameId": 0,
-                            "delimiter": ",",
-                            "delimiter_enabled": true,
-                            "description": "Filter results from mailbox search",
-                            "join": [],
-                            "note": "Remove mailboxes that couldn't be searched or where no results were found"
-                        },
-                        "conditions": [
-                            {
-                                "comparisons": [
-                                    {
-                                        "conditionIndex": 0,
-                                        "op": "==",
-                                        "param": "search_mailboxes:action_result.status",
-                                        "value": "success"
-                                    },
-                                    {
-                                        "conditionIndex": 0,
-                                        "op": ">",
-                                        "param": "search_mailboxes:action_result.summary.total_messages_returned",
-                                        "value": "0"
-                                    }
-                                ],
-                                "conditionIndex": 0,
-                                "customName": "Results found",
-                                "logic": "and"
-                            }
-                        ],
-                        "functionId": 2,
-                        "functionName": "results_filter",
-                        "id": "9",
-                        "type": "filter"
-                    },
-                    "errors": {},
-                    "id": "9",
-                    "type": "filter",
-                    "warnings": {},
-                    "x": 60,
-                    "y": 684
-                }
-            },
-            "notes": "Inputs: internet message id\nInteractions: GSuite For GMail\nActions: get users, run query\nOutputs: observable, markdown report"
+  "blockly": false,
+  "blockly_xml": "<xml></xml>",
+  "category": "Message Identifier Activity Analysis",
+  "coa": {
+    "data": {
+      "description": "Accepts an internet message id, and asks Gmail for a list of mailboxes to search, and then searches each one to look for records that have a matching internet message id.  It then produces a normalized output and summary table.\n\nThis may not work in the intended fashion if your organization has more than 500 mailboxes.\n\nRef: D3-IAA: https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis/",
+      "edges": [
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_3_to_port_4",
+          "sourceNode": "3",
+          "sourcePort": "3_out",
+          "targetNode": "4",
+          "targetPort": "4_in"
         },
-        "input_spec": [
+        {
+          "id": "port_4_to_port_5",
+          "sourceNode": "4",
+          "sourcePort": "4_out",
+          "targetNode": "5",
+          "targetPort": "5_in"
+        },
+        {
+          "id": "port_6_to_port_7",
+          "sourceNode": "6",
+          "sourcePort": "6_out",
+          "targetNode": "7",
+          "targetPort": "7_in"
+        },
+        {
+          "id": "port_7_to_port_1",
+          "sourceNode": "7",
+          "sourcePort": "7_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        },
+        {
+          "id": "port_5_to_port_9",
+          "sourceNode": "5",
+          "sourcePort": "5_out",
+          "targetNode": "9",
+          "targetPort": "9_in"
+        },
+        {
+          "id": "port_0_to_port_3",
+          "sourceNode": "0",
+          "sourcePort": "0_out",
+          "targetNode": "3",
+          "targetPort": "3_in"
+        },
+        {
+          "conditions": [
             {
-                "contains": [
-                    "internet message id"
-                ],
-                "description": "An Internet Message ID to look for within a GMail environment",
-                "name": "message_id"
+              "index": 0
             }
-        ],
-        "output_spec": [
-            {
-                "contains": [],
-                "datapaths": [
-                    "build_message_output:custom_function:observable_array"
-                ],
-                "deduplicate": false,
-                "description": "An array of Observable objects ",
-                "metadata": {},
-                "name": "observable"
+          ],
+          "id": "port_9_to_port_6",
+          "sourceNode": "9",
+          "sourcePort": "9_out",
+          "targetNode": "6",
+          "targetPort": "6_in"
+        }
+      ],
+      "hash": "1f1c3ef7059163a1c5cca6ea4c40150b4628cc1e",
+      "nodes": {
+        "0": {
+          "data": {
+            "advanced": {
+              "join": []
             },
-            {
-                "contains": [],
-                "datapaths": [
-                    "format_message_report:formatted_data"
+            "functionName": "on_start",
+            "id": "0",
+            "type": "start"
+          },
+          "errors": {},
+          "id": "0",
+          "type": "start",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": -1.9184653865522705e-13
+        },
+        "1": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_finish",
+            "id": "1",
+            "type": "end"
+          },
+          "errors": {},
+          "id": "1",
+          "type": "end",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": 1220
+        },
+        "3": {
+          "data": {
+            "advanced": {
+              "customName": "artifact filter",
+              "customNameId": 0,
+              "delimiter": ",",
+              "delimiter_enabled": true,
+              "join": [],
+              "note": "Ensure we have an input"
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:message_id",
+                    "value": "None"
+                  }
                 ],
-                "deduplicate": false,
-                "description": "An array of markdown reports",
-                "metadata": {},
-                "name": "markdown_report"
-            }
-        ],
-        "playbook_type": "data",
-        "python_version": "3",
-        "schema": "5.0.10",
-        "version": "6.0.1.123902"
+                "conditionIndex": 0,
+                "customName": "Input Valid",
+                "logic": "and"
+              }
+            ],
+            "functionId": 1,
+            "functionName": "artifact_filter",
+            "id": "3",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "3",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 148
+        },
+        "4": {
+          "data": {
+            "action": "list users",
+            "actionType": "investigate",
+            "advanced": {
+              "customName": "get mailboxes",
+              "customNameId": 0,
+              "description": "Required step in order to search \"All\" of a Gsuite organization. This receives a list of mailboxes that are passed to the next action.",
+              "join": [],
+              "note": "Gets a list of mailboxes from GMail to search"
+            },
+            "connector": "G Suite for GMail",
+            "connectorConfigs": [
+              "g_suite_for_gmail"
+            ],
+            "connectorId": "9c73f233-2c4a-406a-855e-41d8d2497d0e",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "get_mailboxes",
+            "id": "4",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "max_items": "500",
+              "page_token": ""
+            },
+            "requiredParameters": [],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "4",
+          "type": "action",
+          "warnings": {},
+          "x": 0,
+          "y": 328
+        },
+        "5": {
+          "data": {
+            "action": "run query",
+            "actionType": "investigate",
+            "advanced": {
+              "customName": "search mailboxes",
+              "customNameId": 0,
+              "join": [],
+              "note": "Searches mailboxes returned by the previous action for messages with an internet message ID matching the input"
+            },
+            "connector": "G Suite for GMail",
+            "connectorConfigs": [
+              "g_suite_for_gmail"
+            ],
+            "connectorId": "9c73f233-2c4a-406a-855e-41d8d2497d0e",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "search_mailboxes",
+            "id": "5",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "email": "get_mailboxes:action_result.data.*.emails.*.address",
+              "internet_message_id": "filtered-data:artifact_filter:condition_1:playbook_input:message_id",
+              "label": "Inbox",
+              "max_results": 100,
+              "query": ""
+            },
+            "requiredParameters": [
+              {
+                "data_type": "string",
+                "field": "email"
+              },
+              {
+                "data_type": "string",
+                "default": "Inbox",
+                "field": "label"
+              },
+              {
+                "data_type": "numeric",
+                "default": 100,
+                "field": "max_results"
+              }
+            ],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "5",
+          "type": "action",
+          "warnings": {},
+          "x": 0,
+          "y": 506
+        },
+        "6": {
+          "data": {
+            "advanced": {
+              "customName": "format message report",
+              "customNameId": 0,
+              "join": [],
+              "note": "Format the markdown table summary of this playbook execution"
+            },
+            "functionId": 1,
+            "functionName": "format_message_report",
+            "id": "6",
+            "parameters": [
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.delivered_to",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.to",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.from"
+            ],
+            "template": "SOAR searched for occurrences of `{0}` within your environment using GSuite for GMail. The table below shows a summary of the information gathered.\n\n| Recipient | Addressed To | Subject | Sender |\n| --- | --- | --- | --- |\n%%\n| {1} | {2} | {3} | {4} |\n%%\n",
+            "type": "format"
+          },
+          "errors": {},
+          "id": "6",
+          "type": "format",
+          "userCode": "    \n    \n",
+          "warnings": {},
+          "x": 0,
+          "y": 864
+        },
+        "7": {
+          "data": {
+            "advanced": {
+              "customName": "build message output",
+              "customNameId": 0,
+              "description": "Logic regarding observable construction goes here",
+              "join": [],
+              "note": "Format the observable output object produced by this playbook"
+            },
+            "functionId": 1,
+            "functionName": "build_message_output",
+            "id": "7",
+            "inputParameters": [
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.delivered_to",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.to",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.from",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.id"
+            ],
+            "outputVariables": [
+              "observable_array"
+            ],
+            "type": "code"
+          },
+          "errors": {},
+          "id": "7",
+          "type": "code",
+          "userCode": "\n    # Variable renaming for convenince\n    messageID = filtered_result_0_parameter_internet_message_id\n    recipients = filtered_result_0_data___delivered_to\n    addressees = filtered_result_0_data___to\n    subjects = filtered_result_0_data___subject\n    senders = filtered_result_0_data___from\n    gmailIDs = filtered_result_0_data___id\n    \n    build_message_output__observable_array = []\n    \n    \n    \n        # construct iterables for records\n    for message_id, recipient, addressee, subject, sender, gmailID in zip(messageID, recipients, addressees, subjects, senders, gmailIDs):\n        record = {\n            \"recipient\": recipient,\n            \"addressee\": addressee,\n            \"subject\": subject,\n            \"sender\": sender,\n            \"gmail_id\": gmailID,\n            \"value\": message_id,\n            \"type\": \"internet message ID\",\n            \"source\": \"GSuite for GMail\"\n        }\n            \n        \n        # Create observable body\n    \n        build_message_output__observable_array.append(record)\n    \n\n",
+          "warnings": {},
+          "x": 0,
+          "y": 1040
+        },
+        "9": {
+          "data": {
+            "advanced": {
+              "customName": "results filter",
+              "customNameId": 0,
+              "delimiter": ",",
+              "delimiter_enabled": true,
+              "description": "Filter results from mailbox search",
+              "join": [],
+              "note": "Remove mailboxes that couldn't be searched or where no results were found"
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "==",
+                    "param": "search_mailboxes:action_result.status",
+                    "value": "success"
+                  },
+                  {
+                    "conditionIndex": 0,
+                    "op": ">",
+                    "param": "search_mailboxes:action_result.summary.total_messages_returned",
+                    "value": "0"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Results found",
+                "logic": "and"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "results_filter",
+            "id": "9",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "9",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 684
+        }
+      },
+      "notes": "Inputs: internet message id\nInteractions: GSuite For GMail\nActions: get users, run query\nOutputs: observable, markdown report",
+      "origin": {
+        "playbook_id": 19,
+        "playbook_name": "G_Suite_for_GMail_Message_Identifier_Activity_Analysis",
+        "playbook_repo_id": 1,
+        "playbook_repo_name": "community"
+      }
     },
-    "create_time": "2023-06-16T15:48:09.633490+00:00",
-    "draft_mode": false,
-    "labels": [
-        "*"
+    "input_spec": [
+      {
+        "contains": [
+          "internet message id"
+        ],
+        "description": "An Internet Message ID to look for within a GMail environment",
+        "name": "message_id"
+      }
     ],
-    "tags": [
-        "message_identifier_activity",
-        "internet_message_id",
-        "gsuite_for_gmail",
-        "D3-IAA"
-    ]
-}
+    "output_spec": [
+      {
+        "contains": [],
+        "datapaths": [
+          "build_message_output:custom_function:observable_array"
+        ],
+        "deduplicate": false,
+        "description": "An array of Observable objects ",
+        "metadata": {},
+        "name": "observable"
+      },
+      {
+        "contains": [],
+        "datapaths": [
+          "format_message_report:formatted_data"
+        ],
+        "deduplicate": false,
+        "description": "An array of markdown reports",
+        "metadata": {},
+        "name": "markdown_report"
+      }
+    ],
+    "playbook_type": "data",
+    "python_version": "3",
+    "schema": "5.0.11",
+    "version": "6.2.0.355"
+  },
+  "create_time": "2024-01-29T15:24:50.740963+00:00",
+  "draft_mode": false,
+  "labels": [
+    "*"
+  ],
+  "tags": [
+    "message_identifier_activity",
+    "internet_message_id",
+    "gsuite_for_gmail",
+    "D3-IAA"
+  ]
+}

playbooks/G_Suite_for_GMail_Message_Identifier_Activity_Analysis.py

@@ -18,7 +18,7 @@ def on_start(container):
     return
 
 @phantom.playbook_block()
-def artifact_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+def artifact_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
     phantom.debug("artifact_filter() called")
 
     # collect filtered artifact ids and results for 'if' condition 1
@@ -38,7 +38,7 @@ def artifact_filter(action=None, success=None, container=None, results=None, han
 
 
 @phantom.playbook_block()
-def get_mailboxes(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+def get_mailboxes(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
     phantom.debug("get_mailboxes() called")
 
     # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
@@ -71,7 +71,7 @@ def get_mailboxes(action=None, success=None, container=None, results=None, handl
 
 
 @phantom.playbook_block()
-def search_mailboxes(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+def search_mailboxes(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
     phantom.debug("search_mailboxes() called")
 
     # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
@@ -110,7 +110,7 @@ def search_mailboxes(action=None, success=None, container=None, results=None, ha
 
 
 @phantom.playbook_block()
-def format_message_report(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+def format_message_report(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
     phantom.debug("format_message_report() called")
 
     template = """SOAR searched for occurrences of `{0}` within your environment using GSuite for GMail. The table below shows a summary of the information gathered.\n\n| Recipient | Addressed To | Subject | Sender |\n| --- | --- | --- | --- |\n%%\n| {1} | {2} | {3} | {4} |\n%%\n"""
@@ -141,20 +141,21 @@ def format_message_report(action=None, success=None, container=None, results=Non
 
 
 @phantom.playbook_block()
-def build_message_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+def build_message_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
     phantom.debug("build_message_output() called")
 
     ################################################################################
     # Logic regarding observable construction goes here
     ################################################################################
 
-    filtered_result_0_data_results_filter = phantom.collect2(container=container, datapath=["filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.delivered_to","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.to","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.from"])
+    filtered_result_0_data_results_filter = phantom.collect2(container=container, datapath=["filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.delivered_to","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.to","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.from","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.id"])
 
     filtered_result_0_parameter_internet_message_id = [item[0] for item in filtered_result_0_data_results_filter]
     filtered_result_0_data___delivered_to = [item[1] for item in filtered_result_0_data_results_filter]
     filtered_result_0_data___to = [item[2] for item in filtered_result_0_data_results_filter]
     filtered_result_0_data___subject = [item[3] for item in filtered_result_0_data_results_filter]
     filtered_result_0_data___from = [item[4] for item in filtered_result_0_data_results_filter]
+    filtered_result_0_data___id = [item[5] for item in filtered_result_0_data_results_filter]
 
     build_message_output__observable_array = None
 
@@ -168,32 +169,29 @@ def build_message_output(action=None, success=None, container=None, results=None
     addressees = filtered_result_0_data___to
     subjects = filtered_result_0_data___subject
     senders = filtered_result_0_data___from
+    gmailIDs = filtered_result_0_data___id
     
     build_message_output__observable_array = []
-    recordList = []
     
-    for message_id in messageID:
+    
     
         # construct iterables for records
-        for recipient, addressee, subject, sender in zip(recipients, addressees, subjects, senders):
-            record = {
-                "recipient": recipient,
-                "addressee": addressee,
-                "subject": subject,
-                "sender": sender
-            }
-            recordList.append(record)
-        
-        # Create observable body
-        observable = {
+    for message_id, recipient, addressee, subject, sender, gmailID in zip(messageID, recipients, addressees, subjects, senders, gmailIDs):
+        record = {
+            "recipient": recipient,
+            "addressee": addressee,
+            "subject": subject,
+            "sender": sender,
+            "gmail_id": gmailID,
             "value": message_id,
             "type": "internet message ID",
-            "count": len(recordList),
-            "source": "GSuite for GMail",
-            "message_identifier_activity": recordList
+            "source": "GSuite for GMail"
         }
+            
+        
+        # Create observable body
     
-        build_message_output__observable_array.append(observable)
+        build_message_output__observable_array.append(record)
     
 
     ################################################################################
@@ -206,7 +204,7 @@ def build_message_output(action=None, success=None, container=None, results=None
 
 
 @phantom.playbook_block()
-def results_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+def results_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
     phantom.debug("results_filter() called")
 
     ################################################################################

playbooks/G_Suite_for_Gmail_Message_Eviction.json

@@ -0,0 +1,298 @@
+{
+  "blockly": false,
+  "blockly_xml": "<xml></xml>",
+  "category": "Message Eviction",
+  "coa": {
+    "data": {
+      "description": "Accepts a gmail email ID and a mailbox, and then attempts to delete the email from the mailbox. \n\nCaution: Emails deleted by running this playbook are deleted permanently and cannot be recovered\n\nRef: D3-ER: https://d3fend.mitre.org/technique/d3f:EmailRemoval/",
+      "edges": [
+        {
+          "id": "port_0_to_port_3",
+          "sourceNode": "0",
+          "sourcePort": "0_out",
+          "targetNode": "3",
+          "targetPort": "3_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_3_to_port_4",
+          "sourceNode": "3",
+          "sourcePort": "3_out",
+          "targetNode": "4",
+          "targetPort": "4_in"
+        },
+        {
+          "id": "port_4_to_port_5",
+          "sourceNode": "4",
+          "sourcePort": "4_out",
+          "targetNode": "5",
+          "targetPort": "5_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_5_to_port_6",
+          "sourceNode": "5",
+          "sourcePort": "5_out",
+          "targetNode": "6",
+          "targetPort": "6_in"
+        },
+        {
+          "id": "port_6_to_port_1",
+          "sourceNode": "6",
+          "sourcePort": "6_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        }
+      ],
+      "hash": "aae97f6deeb8f0480b5cd73f61a2f691559961d8",
+      "nodes": {
+        "0": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_start",
+            "id": "0",
+            "type": "start"
+          },
+          "errors": {},
+          "id": "0",
+          "type": "start",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": -2.5579538487363607e-13
+        },
+        "1": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_finish",
+            "id": "1",
+            "type": "end"
+          },
+          "errors": {},
+          "id": "1",
+          "type": "end",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": 834
+        },
+        "3": {
+          "data": {
+            "advanced": {
+              "customName": "input filter",
+              "customNameId": 0,
+              "description": "Filter message_id and email inputs to route inputs to appropriate actions.",
+              "join": [],
+              "note": "Filter message_id and email inputs to route inputs to appropriate actions."
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:message_id",
+                    "value": ""
+                  },
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:email",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "inputs exist",
+                "logic": "and"
+              }
+            ],
+            "functionId": 1,
+            "functionName": "input_filter",
+            "id": "3",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "3",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 148
+        },
+        "4": {
+          "data": {
+            "action": "delete email",
+            "actionType": "contain",
+            "advanced": {
+              "customName": "purge email",
+              "customNameId": 0,
+              "description": "Remove  provided gmail email ID in provided mailbox.",
+              "join": [],
+              "note": "Remove  provided gmail email ID in provided mailbox."
+            },
+            "connector": "G Suite for GMail",
+            "connectorConfigs": [
+              "g_suite_for_gmail"
+            ],
+            "connectorId": "9c73f233-2c4a-406a-855e-41d8d2497d0e",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "purge_email",
+            "id": "4",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "email": "filtered-data:input_filter:condition_1:playbook_input:email",
+              "id": "filtered-data:input_filter:condition_1:playbook_input:message_id"
+            },
+            "requiredParameters": [
+              {
+                "data_type": "string",
+                "field": "id"
+              },
+              {
+                "data_type": "string",
+                "field": "email"
+              }
+            ],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "4",
+          "type": "action",
+          "warnings": {},
+          "x": 0,
+          "y": 328
+        },
+        "5": {
+          "data": {
+            "advanced": {
+              "customName": "post delete filter",
+              "customNameId": 0,
+              "description": "Ensure that the email deletion occurred successfully.",
+              "join": [],
+              "note": "Ensure that the email deletion occurred successfully."
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "==",
+                    "param": "purge_email:action_result.status",
+                    "value": "success"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Successful Deletion",
+                "logic": "and"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "post_delete_filter",
+            "id": "5",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "5",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 500
+        },
+        "6": {
+          "data": {
+            "advanced": {
+              "customName": "observable output",
+              "customNameId": 0,
+              "description": "Format a normalized output for each deleted message.",
+              "join": [],
+              "note": "Format a normalized output for each deleted message."
+            },
+            "functionId": 1,
+            "functionName": "observable_output",
+            "id": "6",
+            "inputParameters": [
+              "filtered-data:post_delete_filter:condition_1:purge_email:action_result.parameter.email",
+              "filtered-data:post_delete_filter:condition_1:purge_email:action_result.parameter.id",
+              "filtered-data:post_delete_filter:condition_1:purge_email:action_result.status",
+              "filtered-data:post_delete_filter:condition_1:purge_email:action_result.message"
+            ],
+            "outputVariables": [
+              "observable_array"
+            ],
+            "type": "code"
+          },
+          "errors": {},
+          "id": "6",
+          "type": "code",
+          "userCode": "\n    \n    observable_output__observable_array = []\n    \n    emails = filtered_result_0_parameter_email\n    messageID = filtered_result_0_parameter_id\n    Statuses = filtered_result_0_status\n    Messages = filtered_result_0_message\n    \n    for email, message_id, status, message in zip(emails, messageID, Statuses, Messages):\n        observable = {\n            \"mailbox\": email,\n            \"message_id\": message_id,\n            \"status\": \"deleted\",\n            \"message\": message,\n            \"source\": \"GSuite for GMail\"\n        }\n        observable_output__observable_array.append(observable)\n\n",
+          "warnings": {},
+          "x": 0,
+          "y": 686
+        }
+      },
+      "notes": "Inputs: gmail email id, email\nActions: delete email\nOutputs: observable array"
+    },
+    "input_spec": [
+      {
+        "contains": [
+          "gmail email id"
+        ],
+        "description": "GMail Email ID that should be deleted",
+        "name": "message_id"
+      },
+      {
+        "contains": [
+          "email"
+        ],
+        "description": "Email Mailbox to that contains the GMail Email ID",
+        "name": "email"
+      }
+    ],
+    "output_spec": [
+      {
+        "contains": [],
+        "datapaths": [
+          "observable_output:custom_function:observable_array"
+        ],
+        "deduplicate": false,
+        "description": "An array of Observable objects ",
+        "metadata": {},
+        "name": "observable"
+      }
+    ],
+    "playbook_type": "data",
+    "python_version": "3",
+    "schema": "5.0.11",
+    "version": "6.2.0.355"
+  },
+  "create_time": "2024-02-27T14:51:16.635992+00:00",
+  "draft_mode": false,
+  "labels": [
+    "*"
+  ],
+  "tags": [
+    "message_eviction",
+    "D3-ER",
+    "gsuite_for_gmail",
+    "gmail_email_id",
+    "email"
+  ]
+}

playbooks/G_Suite_for_Gmail_Message_Eviction.py

@@ -0,0 +1,179 @@
+"""
+Accepts a gmail email ID and a mailbox, and then attempts to delete the email from the mailbox. \n\nCaution: Emails deleted by running this playbook are deleted permanently and cannot be recovered\n\nRef: D3-ER: https://d3fend.mitre.org/technique/d3f:EmailRemoval/
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'input_filter' block
+    input_filter(container=container)
+
+    return
+
+@phantom.playbook_block()
+def input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_filter() called")
+
+    ################################################################################
+    # Filter message_id and email inputs to route inputs to appropriate actions.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        logical_operator="and",
+        conditions=[
+            ["playbook_input:message_id", "!=", ""],
+            ["playbook_input:email", "!=", ""]
+        ],
+        name="input_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        purge_email(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def purge_email(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("purge_email() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    ################################################################################
+    # Remove  provided gmail email ID in provided mailbox.
+    ################################################################################
+
+    filtered_input_0_message_id = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_1:playbook_input:message_id"])
+    filtered_input_1_email = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_1:playbook_input:email"])
+
+    parameters = []
+
+    # build parameters list for 'purge_email' call
+    for filtered_input_0_message_id_item in filtered_input_0_message_id:
+        for filtered_input_1_email_item in filtered_input_1_email:
+            if filtered_input_0_message_id_item[0] is not None and filtered_input_1_email_item[0] is not None:
+                parameters.append({
+                    "id": filtered_input_0_message_id_item[0],
+                    "email": filtered_input_1_email_item[0],
+                })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("delete email", parameters=parameters, name="purge_email", assets=["g_suite_for_gmail"], callback=post_delete_filter)
+
+    return
+
+
+@phantom.playbook_block()
+def post_delete_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("post_delete_filter() called")
+
+    ################################################################################
+    # Ensure that the email deletion occurred successfully.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["purge_email:action_result.status", "==", "success"]
+        ],
+        name="post_delete_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        observable_output(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def observable_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("observable_output() called")
+
+    ################################################################################
+    # Format a normalized output for each deleted message.
+    ################################################################################
+
+    filtered_result_0_data_post_delete_filter = phantom.collect2(container=container, datapath=["filtered-data:post_delete_filter:condition_1:purge_email:action_result.parameter.email","filtered-data:post_delete_filter:condition_1:purge_email:action_result.parameter.id","filtered-data:post_delete_filter:condition_1:purge_email:action_result.status","filtered-data:post_delete_filter:condition_1:purge_email:action_result.message"])
+
+    filtered_result_0_parameter_email = [item[0] for item in filtered_result_0_data_post_delete_filter]
+    filtered_result_0_parameter_id = [item[1] for item in filtered_result_0_data_post_delete_filter]
+    filtered_result_0_status = [item[2] for item in filtered_result_0_data_post_delete_filter]
+    filtered_result_0_message = [item[3] for item in filtered_result_0_data_post_delete_filter]
+
+    observable_output__observable_array = None
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    
+    observable_output__observable_array = []
+    
+    emails = filtered_result_0_parameter_email
+    messageID = filtered_result_0_parameter_id
+    Statuses = filtered_result_0_status
+    Messages = filtered_result_0_message
+    
+    for email, message_id, status, message in zip(emails, messageID, Statuses, Messages):
+        observable = {
+            "mailbox": email,
+            "message_id": message_id,
+            "status": "deleted",
+            "message": message,
+            "source": "GSuite for GMail"
+        }
+        observable_output__observable_array.append(observable)
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_run_data(key="observable_output:observable_array", value=json.dumps(observable_output__observable_array))
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    observable_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="observable_output:observable_array")) != "" else "null")  # pylint: disable=used-before-assignment
+
+    output = {
+        "observable": observable_output__observable_array,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_playbook_output_data(output=output)
+
+    return

playbooks/G_Suite_for_Gmail_Message_Eviction.yml

@@ -0,0 +1,25 @@
+name: G Suite for Gmail Message Eviction
+id: 5299d3ad-e9c4-4afa-b051-92cacd0ff916
+version: 1
+date: '2024-01-21'
+author: Lou Stella, Splunk
+type: Response
+description: Accepts a gmail email ID, and then attempts to delete the email from the mailbox. GMail does not have a "soft-delete" option, messages run through the Message Eviction playbook will be permanently deleted.
+playbook: G_Suite_for_Gmail_Message_Eviction
+how_to_implement: This input playbook requires the G Suite for GMail connector to be configured. It is designed to work in environments that posess a maximum of 500 mailboxes at this time, due to a limitation in the G Suite for GMail connector. 
+references: []
+app_list: 
+  - G Suite for GMail
+tags:
+  platform_tags:
+    - message_eviction
+    - gmail_email_id
+    - gsuite_for_gmail
+  playbook_type: Input
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: D3-ER

playbooks/G_Suite_for_Gmail_Search_and_Purge.json

@@ -0,0 +1,870 @@
+{
+  "blockly": false,
+  "blockly_xml": "<xml></xml>",
+  "category": "Search and Purge",
+  "coa": {
+    "data": {
+      "description": "Accepts an Internet Message ID, searches for its presence in up to 500 mailboxes, and then deletes the ones it finds. \n\nCaution: Emails deleted by running this playbook are deleted permanently and cannot be recovered",
+      "edges": [
+        {
+          "id": "port_11_to_port_12",
+          "sourceNode": "11",
+          "sourcePort": "11_out",
+          "targetNode": "12",
+          "targetPort": "12_in"
+        },
+        {
+          "id": "port_12_to_port_13",
+          "sourceNode": "12",
+          "sourcePort": "12_out",
+          "targetNode": "13",
+          "targetPort": "13_in"
+        },
+        {
+          "id": "port_13_to_port_1",
+          "sourceNode": "13",
+          "sourcePort": "13_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        },
+        {
+          "id": "port_5_to_port_14",
+          "sourceNode": "5",
+          "sourcePort": "5_out",
+          "targetNode": "14",
+          "targetPort": "14_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 1
+            }
+          ],
+          "id": "port_14_to_port_10",
+          "sourceNode": "14",
+          "sourcePort": "14_out",
+          "targetNode": "10",
+          "targetPort": "10_in"
+        },
+        {
+          "id": "port_0_to_port_16",
+          "sourceNode": "0",
+          "sourcePort": "0_out",
+          "targetNode": "16",
+          "targetPort": "16_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_16_to_port_17",
+          "sourceNode": "16",
+          "sourcePort": "16_out",
+          "targetNode": "17",
+          "targetPort": "17_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_17_to_port_5",
+          "sourceNode": "17",
+          "sourcePort": "17_out",
+          "targetNode": "5",
+          "targetPort": "5_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 1
+            }
+          ],
+          "id": "port_16_to_port_6",
+          "sourceNode": "16",
+          "sourcePort": "16_out",
+          "targetNode": "6",
+          "targetPort": "6_in"
+        },
+        {
+          "id": "port_18_to_port_19",
+          "sourceNode": "18",
+          "sourcePort": "18_out",
+          "targetNode": "19",
+          "targetPort": "19_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_19_to_port_11",
+          "sourceNode": "19",
+          "sourcePort": "19_out",
+          "targetNode": "11",
+          "targetPort": "11_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 1
+            }
+          ],
+          "id": "port_19_to_port_1",
+          "sourceNode": "19",
+          "sourcePort": "19_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_14_to_port_20",
+          "sourceNode": "14",
+          "sourcePort": "14_out",
+          "targetNode": "20",
+          "targetPort": "20_in"
+        },
+        {
+          "id": "port_20_to_port_18",
+          "sourceNode": "20",
+          "sourcePort": "20_out",
+          "targetNode": "18",
+          "targetPort": "18_in"
+        }
+      ],
+      "hash": "e9cce56fb0ba3db0c306520b32adfec5599309ac",
+      "nodes": {
+        "0": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_start",
+            "id": "0",
+            "type": "start"
+          },
+          "errors": {},
+          "id": "0",
+          "type": "start",
+          "warnings": {},
+          "x": 160,
+          "y": -6.394884621840902e-14
+        },
+        "1": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_finish",
+            "id": "1",
+            "type": "end"
+          },
+          "errors": {},
+          "id": "1",
+          "type": "end",
+          "warnings": {},
+          "x": 470,
+          "y": 1926
+        },
+        "10": {
+          "data": {
+            "advanced": {
+              "customName": "No Observable Found",
+              "customNameId": 0,
+              "description": "In the event the Message Identifier Activity Analysis playbook does not return an observable, inform the user.",
+              "join": [],
+              "note": "In the event the Message Identifier Activity Analysis playbook does not return an observable, inform the user."
+            },
+            "functionId": 2,
+            "functionName": "no_observable_found",
+            "id": "10",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "selectMore": false,
+            "tab": "apis",
+            "type": "utility",
+            "utilities": {
+              "comment": {
+                "description": "",
+                "fields": [
+                  {
+                    "description": "",
+                    "label": "comment",
+                    "name": "comment",
+                    "placeholder": "Enter a comment",
+                    "renderType": "datapath",
+                    "required": true
+                  },
+                  {
+                    "hidden": true,
+                    "name": "container",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "author",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "trace",
+                    "required": false
+                  }
+                ],
+                "label": "add comment",
+                "name": "comment"
+              }
+            },
+            "utilityType": "api",
+            "values": {
+              "comment": {
+                "_internal": [
+                  "container",
+                  "author",
+                  "trace"
+                ],
+                "comment": "No observable output found for dispatched playbook."
+              }
+            }
+          },
+          "errors": {},
+          "id": "10",
+          "type": "utility",
+          "warnings": {},
+          "x": 110,
+          "y": 868
+        },
+        "11": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionId": 1,
+            "functionName": "playbook_G_Suite_for_Gmail_Message_Eviction_1",
+            "id": "11",
+            "inputs": {
+              "email": {
+                "datapaths": [
+                  "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.recipient"
+                ],
+                "deduplicate": false
+              },
+              "message_id": {
+                "datapaths": [
+                  "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.gmail_id"
+                ],
+                "deduplicate": false
+              }
+            },
+            "loop": {
+              "conditions": [
+                {
+                  "comparisons": [
+                    {
+                      "conditionIndex": 0,
+                      "op": "==",
+                      "param": "",
+                      "value": ""
+                    }
+                  ],
+                  "conditionIndex": 0,
+                  "display": "If",
+                  "logic": "and",
+                  "type": "if"
+                }
+              ],
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "playbookName": "G_Suite_for_Gmail_Message_Eviction",
+            "playbookRepo": 2,
+            "playbookRepoName": "local",
+            "playbookType": "data",
+            "synchronous": true,
+            "type": "playbook"
+          },
+          "errors": {},
+          "id": "11",
+          "type": "playbook",
+          "userCode": "\n    \n\n",
+          "warnings": {},
+          "x": 360,
+          "y": 1406
+        },
+        "12": {
+          "data": {
+            "advanced": {
+              "customName": "format note",
+              "customNameId": 0,
+              "description": "Format the output of the Message Eviction playbook to provide a table to the user showing the deleted messages.",
+              "join": [],
+              "note": "Format the output of the Message Eviction playbook to provide a table to the user showing the deleted messages."
+            },
+            "functionId": 1,
+            "functionName": "format_note",
+            "id": "12",
+            "parameters": [
+              "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.mailbox",
+              "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.message_id",
+              "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.status",
+              "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.message"
+            ],
+            "template": "SOAR deleted messages in GMail. The table below shows a summary of the messages.\n\n| Mailbox | Message ID | Status | Message |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%",
+            "type": "format"
+          },
+          "errors": {},
+          "id": "12",
+          "type": "format",
+          "warnings": {},
+          "x": 360,
+          "y": 1570
+        },
+        "13": {
+          "data": {
+            "advanced": {
+              "customName": "Update Workbook Task",
+              "customNameId": 0,
+              "description": "Upon completion, update the workbook task with the formatted output and mark task as complete.",
+              "join": [],
+              "note": "Upon completion, update the workbook task with the formatted output and mark task as complete."
+            },
+            "customFunction": {
+              "draftMode": false,
+              "name": "workbook_task_update",
+              "repoName": "community"
+            },
+            "functionId": 3,
+            "functionName": "update_workbook_task",
+            "id": "13",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "selectMore": false,
+            "type": "utility",
+            "utilities": {
+              "workbook_task_update": {
+                "description": "Update a workbook task by task name or the task where the currently running playbook appears. Requires a task_name, container_id, and a note_title, note_content, owner, or status.",
+                "fields": [
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Name of a workbook task or keyword 'playbook' to update the task where the currently running playbook appears. (Required)",
+                    "inputType": "item",
+                    "label": "task_name",
+                    "name": "task_name",
+                    "placeholder": "my_task",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Note title. (Optional)",
+                    "inputType": "item",
+                    "label": "note_title",
+                    "name": "note_title",
+                    "placeholder": "My Title",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Note content. (Optional)",
+                    "inputType": "item",
+                    "label": "note_content",
+                    "name": "note_content",
+                    "placeholder": "My notes",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Accepts 'incomplete', 'in_progress, or 'complete'. (Optional)",
+                    "inputType": "item",
+                    "label": "status",
+                    "name": "status",
+                    "placeholder": "in_progress",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "A user to assign as the task owner or keyword 'current\" to assign the task to the user that launched the playbook. (Optional)",
+                    "inputType": "item",
+                    "label": "owner",
+                    "name": "owner",
+                    "placeholder": "username",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "phantom container id"
+                    ],
+                    "description": "The ID of a SOAR Container. (Required)",
+                    "inputType": "item",
+                    "label": "container",
+                    "name": "container",
+                    "placeholder": "container:id",
+                    "renderType": "datapath",
+                    "required": false
+                  }
+                ],
+                "label": "workbook_task_update",
+                "name": "workbook_task_update"
+              }
+            },
+            "utilityType": "custom_function",
+            "values": {
+              "workbook_task_update": {
+                "container": "container:id",
+                "note_content": "format_note:formatted_data",
+                "note_title": "Search & Purge Results",
+                "owner": null,
+                "status": "complete",
+                "task_name": "playbook"
+              }
+            }
+          },
+          "errors": {},
+          "id": "13",
+          "type": "utility",
+          "warnings": {},
+          "x": 360,
+          "y": 1748
+        },
+        "14": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "g_suite_message_identifier_activity_analysis:playbook_output:observable",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "observable exists",
+                "logic": "and"
+              },
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 1,
+                    "op": "==",
+                    "param": "g_suite_message_identifier_activity_analysis:playbook_output:observable",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 1,
+                "customName": "observable does not exist",
+                "logic": "and"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "filter_2",
+            "id": "14",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "14",
+          "type": "filter",
+          "warnings": {},
+          "x": 340,
+          "y": 688
+        },
+        "16": {
+          "data": {
+            "advanced": {
+              "customName": "input decision",
+              "customNameId": 0,
+              "join": []
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "artifact:*.cef.internet message id",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "internet message id exists",
+                "display": "If",
+                "logic": "and",
+                "type": "if"
+              },
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 1,
+                    "op": "==",
+                    "param": "",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 1,
+                "customName": "message id does not exist",
+                "display": "Else",
+                "logic": "and",
+                "type": "else"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "input_decision",
+            "id": "16",
+            "type": "decision"
+          },
+          "errors": {},
+          "id": "16",
+          "type": "decision",
+          "warnings": {},
+          "x": 220,
+          "y": 148
+        },
+        "17": {
+          "data": {
+            "advanced": {
+              "customName": "input filter",
+              "customNameId": 0,
+              "join": []
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "artifact:*.cef.internet message id",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "internet message id exists",
+                "logic": "and"
+              }
+            ],
+            "functionId": 3,
+            "functionName": "input_filter",
+            "id": "17",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "17",
+          "type": "filter",
+          "warnings": {},
+          "x": 340,
+          "y": 328
+        },
+        "18": {
+          "data": {
+            "advanced": {
+              "customName": "Delete Email Prompt",
+              "customNameId": 0,
+              "join": []
+            },
+            "approver": {
+              "type": "user",
+              "value": "container_owner"
+            },
+            "functionId": 1,
+            "functionName": "delete_email_prompt",
+            "id": "18",
+            "message": "The following emails will be permanently deleted. This is a hard deletion. Only restoration from backups of your own will restore these.\n\n{0} ",
+            "parameters": [
+              "format_prompt:formatted_data"
+            ],
+            "responseTime": 30,
+            "responses": [
+              {
+                "responseOptions": [
+                  "Yes",
+                  "No"
+                ],
+                "responsePrompt": "Delete these messages?",
+                "responseType": "yes/no"
+              }
+            ],
+            "type": "prompt"
+          },
+          "errors": {},
+          "id": "18",
+          "type": "prompt",
+          "warnings": {},
+          "x": 530,
+          "y": 1046
+        },
+        "19": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "==",
+                    "param": "delete_email_prompt:action_result.summary.responses.0",
+                    "value": "yes"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "User confirm delete",
+                "display": "If",
+                "logic": "and",
+                "type": "if"
+              },
+              {
+                "comparisons": [
+                  {
+                    "op": "==",
+                    "param": "",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 1,
+                "customName": "User decline delete",
+                "display": "Else",
+                "logic": "and",
+                "type": "else"
+              }
+            ],
+            "functionId": 3,
+            "functionName": "decision_3",
+            "id": "19",
+            "type": "decision"
+          },
+          "errors": {},
+          "id": "19",
+          "type": "decision",
+          "warnings": {},
+          "x": 530,
+          "y": 1226
+        },
+        "20": {
+          "data": {
+            "advanced": {
+              "customName": "format prompt",
+              "customNameId": 0,
+              "join": []
+            },
+            "functionId": 2,
+            "functionName": "format_prompt",
+            "id": "20",
+            "parameters": [
+              "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.recipient",
+              "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.subject",
+              "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.value"
+            ],
+            "template": "| Mailbox | Subject | Email ID |\n| --- | --- | --- |\n%%\n| {0} | {1} | {2} |\n%%\n",
+            "type": "format"
+          },
+          "errors": {},
+          "id": "20",
+          "type": "format",
+          "warnings": {},
+          "x": 450,
+          "y": 883
+        },
+        "5": {
+          "data": {
+            "advanced": {
+              "customName": "G_Suite_Message_Identifier_Activity_Analysis",
+              "customNameId": 0,
+              "join": []
+            },
+            "functionId": 2,
+            "functionName": "g_suite_message_identifier_activity_analysis",
+            "id": "5",
+            "inputs": {
+              "message_id": {
+                "datapaths": [
+                  "filtered-data:input_filter:condition_1:artifact:*.cef.internet message id"
+                ],
+                "deduplicate": false
+              }
+            },
+            "loop": {
+              "conditions": [
+                {
+                  "comparisons": [
+                    {
+                      "conditionIndex": 0,
+                      "op": "==",
+                      "param": "",
+                      "value": ""
+                    }
+                  ],
+                  "conditionIndex": 0,
+                  "display": "If",
+                  "logic": "and",
+                  "type": "if"
+                }
+              ],
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "playbookName": "G_Suite_for_GMail_Message_Identifier_Activity_Analysis",
+            "playbookRepo": 2,
+            "playbookRepoName": "local",
+            "playbookType": "data",
+            "synchronous": true,
+            "type": "playbook"
+          },
+          "errors": {},
+          "id": "5",
+          "type": "playbook",
+          "warnings": {
+            "config": [
+              "Reconfigure invalid datapath."
+            ]
+          },
+          "x": 280,
+          "y": 508
+        },
+        "6": {
+          "data": {
+            "advanced": {
+              "customName": "artifact does not exist",
+              "customNameId": 0,
+              "description": "In the event an artifact does not exist suitable for this usecase, inform the user.",
+              "join": [],
+              "note": "In the event an artifact does not exist suitable for this usecase, inform the user."
+            },
+            "functionId": 1,
+            "functionName": "artifact_does_not_exist",
+            "id": "6",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "selectMore": false,
+            "tab": "apis",
+            "type": "utility",
+            "utilities": {
+              "comment": {
+                "description": "",
+                "fields": [
+                  {
+                    "description": "",
+                    "label": "comment",
+                    "name": "comment",
+                    "placeholder": "Enter a comment",
+                    "renderType": "datapath",
+                    "required": true
+                  },
+                  {
+                    "hidden": true,
+                    "name": "container",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "author",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "trace",
+                    "required": false
+                  }
+                ],
+                "label": "add comment",
+                "name": "comment"
+              }
+            },
+            "utilityType": "api",
+            "values": {
+              "comment": {
+                "_internal": [
+                  "container",
+                  "author",
+                  "trace"
+                ],
+                "comment": "\"No Internet Message ID artifacts found\""
+              }
+            }
+          },
+          "errors": {},
+          "id": "6",
+          "type": "utility",
+          "warnings": {},
+          "x": 0,
+          "y": 329
+        }
+      },
+      "notes": "Inputs: internet message ID\nActions: Message Identifier Activity Analysis, Message Eviction\nOutputs: report, workbook update task"
+    },
+    "input_spec": null,
+    "output_spec": null,
+    "playbook_type": "automation",
+    "python_version": "3",
+    "schema": "5.0.11",
+    "version": "6.2.0.355"
+  },
+  "create_time": "2024-02-27T14:52:07.495914+00:00",
+  "draft_mode": false,
+  "labels": [
+    "*"
+  ],
+  "tags": [
+    "message_identifier_activity",
+    "message_eviction",
+    "D3-IAA",
+    "D3-ER",
+    "gsuite_for_gmail",
+    "internet_message_id"
+  ]
+}

playbooks/G_Suite_for_Gmail_Search_and_Purge.py

@@ -0,0 +1,374 @@
+"""
+Accepts an Internet Message ID, searches for its presence in up to 500 mailboxes, and then deletes the ones it finds. \n\nCaution: Emails deleted by running this playbook are deleted permanently and cannot be recovered
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'input_decision' block
+    input_decision(container=container)
+
+    return
+
+@phantom.playbook_block()
+def g_suite_message_identifier_activity_analysis(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("g_suite_message_identifier_activity_analysis() called")
+
+    filtered_artifact_0_data_input_filter = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_1:artifact:*.cef.internet message id"])
+
+    filtered_artifact_0__cef_internet_message_id = [item[0] for item in filtered_artifact_0_data_input_filter]
+
+    inputs = {
+        "message_id": filtered_artifact_0__cef_internet_message_id,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    # call playbook "local/G_Suite_for_GMail_Message_Identifier_Activity_Analysis", returns the playbook_run_id
+    playbook_run_id = phantom.playbook("local/G_Suite_for_GMail_Message_Identifier_Activity_Analysis", container=container, name="g_suite_message_identifier_activity_analysis", callback=filter_2, inputs=inputs)
+
+    return
+
+
+@phantom.playbook_block()
+def artifact_does_not_exist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("artifact_does_not_exist() called")
+
+    ################################################################################
+    # In the event an artifact does not exist suitable for this usecase, inform the 
+    # user.
+    ################################################################################
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.comment(container=container, comment="\"No Internet Message ID artifacts found\"")
+
+    return
+
+
+@phantom.playbook_block()
+def no_observable_found(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("no_observable_found() called")
+
+    ################################################################################
+    # In the event the Message Identifier Activity Analysis playbook does not return 
+    # an observable, inform the user.
+    ################################################################################
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.comment(container=container, comment="No observable output found for dispatched playbook.")
+
+    return
+
+
+@phantom.playbook_block()
+def playbook_g_suite_for_gmail_message_eviction_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("playbook_g_suite_for_gmail_message_eviction_1() called")
+
+    filtered_output_0_g_suite_message_identifier_activity_analysis_output_observable = phantom.collect2(container=container, datapath=["filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.recipient","filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.gmail_id"])
+
+    filtered_output_0_g_suite_message_identifier_activity_analysis_output_observable_recipient = [item[0] for item in filtered_output_0_g_suite_message_identifier_activity_analysis_output_observable]
+    filtered_output_0_g_suite_message_identifier_activity_analysis_output_observable_gmail_id = [item[1] for item in filtered_output_0_g_suite_message_identifier_activity_analysis_output_observable]
+
+    inputs = {
+        "email": filtered_output_0_g_suite_message_identifier_activity_analysis_output_observable_recipient,
+        "message_id": filtered_output_0_g_suite_message_identifier_activity_analysis_output_observable_gmail_id,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    # call playbook "local/G_Suite_for_Gmail_Message_Eviction", returns the playbook_run_id
+    playbook_run_id = phantom.playbook("local/G_Suite_for_Gmail_Message_Eviction", container=container, name="playbook_g_suite_for_gmail_message_eviction_1", callback=format_note, inputs=inputs)
+
+    return
+
+
+@phantom.playbook_block()
+def format_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("format_note() called")
+
+    ################################################################################
+    # Format the output of the Message Eviction playbook to provide a table to the 
+    # user showing the deleted messages.
+    ################################################################################
+
+    template = """SOAR deleted messages in GMail. The table below shows a summary of the messages.\n\n| Mailbox | Message ID | Status | Message |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.mailbox",
+        "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.message_id",
+        "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.status",
+        "playbook_g_suite_for_gmail_message_eviction_1:playbook_output:observable.message"
+    ]
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_note")
+
+    update_workbook_task(container=container)
+
+    return
+
+
+@phantom.playbook_block()
+def update_workbook_task(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("update_workbook_task() called")
+
+    ################################################################################
+    # Upon completion, update the workbook task with the formatted output and mark 
+    # task as complete.
+    ################################################################################
+
+    id_value = container.get("id", None)
+    format_note = phantom.get_format_data(name="format_note")
+
+    parameters = []
+
+    parameters.append({
+        "owner": None,
+        "status": "complete",
+        "container": id_value,
+        "task_name": "playbook",
+        "note_title": "Search & Purge Results",
+        "note_content": format_note,
+    })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.custom_function(custom_function="community/workbook_task_update", parameters=parameters, name="update_workbook_task")
+
+    return
+
+
+@phantom.playbook_block()
+def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("filter_2() called")
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["g_suite_message_identifier_activity_analysis:playbook_output:observable", "!=", ""]
+        ],
+        name="filter_2:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        format_prompt(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    # collect filtered artifact ids and results for 'if' condition 2
+    matched_artifacts_2, matched_results_2 = phantom.condition(
+        container=container,
+        conditions=[
+            ["g_suite_message_identifier_activity_analysis:playbook_output:observable", "==", ""]
+        ],
+        name="filter_2:condition_2",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_2 or matched_results_2:
+        no_observable_found(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)
+
+    return
+
+
+@phantom.playbook_block()
+def input_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_decision() called")
+
+    # check for 'if' condition 1
+    found_match_1 = phantom.decision(
+        container=container,
+        conditions=[
+            ["artifact:*.cef.internet message id", "!=", ""]
+        ],
+        delimiter=None)
+
+    # call connected blocks if condition 1 matched
+    if found_match_1:
+        input_filter(action=action, success=success, container=container, results=results, handle=handle)
+        return
+
+    # check for 'else' condition 2
+    artifact_does_not_exist(action=action, success=success, container=container, results=results, handle=handle)
+
+    return
+
+
+@phantom.playbook_block()
+def input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_filter() called")
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["artifact:*.cef.internet message id", "!=", ""]
+        ],
+        name="input_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        g_suite_message_identifier_activity_analysis(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def delete_email_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("delete_email_prompt() called")
+
+    # set user and message variables for phantom.prompt call
+
+    user = container.get('owner_name', None)
+    role = None
+    message = """The following emails will be permanently deleted. This is a hard deletion. Only restoration from backups of your own will restore these.\n\n{0} """
+
+    # parameter list for template variable replacement
+    parameters = [
+        "format_prompt:formatted_data"
+    ]
+
+    # responses
+    response_types = [
+        {
+            "prompt": "Delete these messages?",
+            "options": {
+                "type": "list",
+                "choices": [
+                    "Yes",
+                    "No"
+                ],
+            },
+        }
+    ]
+
+    phantom.prompt2(container=container, user=user, role=role, message=message, respond_in_mins=30, name="delete_email_prompt", parameters=parameters, response_types=response_types, callback=decision_3)
+
+    return
+
+
+@phantom.playbook_block()
+def decision_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("decision_3() called")
+
+    # check for 'if' condition 1
+    found_match_1 = phantom.decision(
+        container=container,
+        conditions=[
+            ["delete_email_prompt:action_result.summary.responses.0", "==", "yes"]
+        ],
+        delimiter=None)
+
+    # call connected blocks if condition 1 matched
+    if found_match_1:
+        playbook_g_suite_for_gmail_message_eviction_1(action=action, success=success, container=container, results=results, handle=handle)
+        return
+
+    return
+
+
+@phantom.playbook_block()
+def format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("format_prompt() called")
+
+    template = """| Mailbox | Subject | Email ID |\n| --- | --- | --- |\n%%\n| {0} | {1} | {2} |\n%%\n"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.recipient",
+        "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.subject",
+        "filtered-data:filter_2:condition_1:g_suite_message_identifier_activity_analysis:playbook_output:observable.value"
+    ]
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_prompt")
+
+    delete_email_prompt(container=container)
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    return

playbooks/G_Suite_for_Gmail_Search_and_Purge.yml

@@ -0,0 +1,29 @@
+name: G Suite for Gmail Search and Purge
+id: 5294d3bd-e9c4-4bfa-b051-92cacd0ff925
+version: 1
+date: '2024-02-19'
+author: Lou Stella, Splunk
+type: Response
+description: Accepts an Internet Message ID, searches for its presence in up to 500 mailboxes, and then deletes the ones it finds. GMail does not have a "soft-delete" option, messages run through the Message Eviction playbook will be permanently deleted.
+playbook: G_Suite_for_Gmail_Search_and_Purge
+how_to_implement: This input playbook requires the G Suite for GMail connector to be configured. It is designed to work in environments that posess a maximum of 500 mailboxes at this time, due to a limitation in the G Suite for GMail connector. 
+references: []
+app_list: 
+  - G Suite for GMail
+tags:
+  platform_tags:
+    - message_eviction
+    - message_identifier_activity
+    - gmail_email_id
+    - internet_message_id
+    - gsuite_for_gmail
+  playbook_type: Automation
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: 
+    - D3-ER
+    - D3-IAA

playbooks/MS_Graph_for_Office_365_Message_Eviction.json

@@ -0,0 +1,416 @@
+{
+  "blockly": false,
+  "blockly_xml": "<xml></xml>",
+  "category": "Message Eviction",
+  "coa": {
+    "data": {
+      "description": "Accepts message ID that needs to be evicted from provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message eviction.\n\nRef: D3-ER\nhttps://d3fend.mitre.org/technique/d3f:EmailRemoval/",
+      "edges": [
+        {
+          "id": "port_0_to_port_6",
+          "sourceNode": "0",
+          "sourcePort": "0_out",
+          "targetNode": "6",
+          "targetPort": "6_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_6_to_port_2",
+          "sourceNode": "6",
+          "sourcePort": "6_out",
+          "targetNode": "2",
+          "targetPort": "2_in"
+        },
+        {
+          "id": "port_4_to_port_1",
+          "sourceNode": "4",
+          "sourcePort": "4_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        },
+        {
+          "id": "port_2_to_port_7",
+          "sourceNode": "2",
+          "sourcePort": "2_out",
+          "targetNode": "7",
+          "targetPort": "7_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_7_to_port_3",
+          "sourceNode": "7",
+          "sourcePort": "7_out",
+          "targetNode": "3",
+          "targetPort": "3_in"
+        },
+        {
+          "id": "port_3_to_port_8",
+          "sourceNode": "3",
+          "sourcePort": "3_out",
+          "targetNode": "8",
+          "targetPort": "8_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_8_to_port_4",
+          "sourceNode": "8",
+          "sourcePort": "8_out",
+          "targetNode": "4",
+          "targetPort": "4_in"
+        }
+      ],
+      "hash": "4c161da025f50532d7da3e3fe1fa336b1f692eab",
+      "nodes": {
+        "0": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_start",
+            "id": "0",
+            "type": "start"
+          },
+          "errors": {},
+          "id": "0",
+          "type": "start",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": -1.2789769243681803e-13
+        },
+        "1": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_finish",
+            "id": "1",
+            "type": "end"
+          },
+          "errors": {},
+          "id": "1",
+          "type": "end",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": 1238
+        },
+        "2": {
+          "data": {
+            "action": "run query",
+            "actionType": "investigate",
+            "advanced": {
+              "customName": "search o365 for email",
+              "customNameId": 0,
+              "description": "Search for  provided message ID in provided mailbox from filtered playbook inputs.",
+              "join": [],
+              "note": "Search for  provided message ID in provided mailbox from filtered playbook inputs."
+            },
+            "connector": "MS Graph for Office 365",
+            "connectorConfigs": [
+              "ms_graph_for_office_365"
+            ],
+            "connectorId": "0a0a4087-10e8-4c96-9872-b740ff26d8bb",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "search_o365_for_email",
+            "id": "2",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "email_address": "filtered-data:input_validation_filter:condition_1:playbook_input:email",
+              "folder": "Inbox",
+              "get_folder_id": true,
+              "internet_message_id": "filtered-data:input_validation_filter:condition_1:playbook_input:message_id",
+              "search_well_known_folders": true
+            },
+            "requiredParameters": [
+              {
+                "data_type": "string",
+                "default": "Inbox",
+                "field": "folder"
+              },
+              {
+                "data_type": "string",
+                "field": "email_address"
+              },
+              {
+                "data_type": "boolean",
+                "default": true,
+                "field": "get_folder_id"
+              }
+            ],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "2",
+          "type": "action",
+          "userCode": "\n    # Write your custom code here...\n    \n\n",
+          "warnings": {},
+          "x": 0,
+          "y": 328
+        },
+        "3": {
+          "data": {
+            "action": "delete email",
+            "actionType": "contain",
+            "advanced": {
+              "customName": "purge email",
+              "customNameId": 0,
+              "description": "Remove  provided message ID in provided mailbox from filtered query outputs.",
+              "join": [],
+              "note": "Search for  provided message ID in provided mailbox from filtered query outputs."
+            },
+            "connector": "MS Graph for Office 365",
+            "connectorConfigs": [
+              "ms_graph_for_office_365"
+            ],
+            "connectorId": "0a0a4087-10e8-4c96-9872-b740ff26d8bb",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "purge_email",
+            "id": "3",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "email_address": "filtered-data:filter_run_query:condition_1:search_o365_for_email:action_result.parameter.email_address",
+              "id": "filtered-data:filter_run_query:condition_1:search_o365_for_email:action_result.data.*.id"
+            },
+            "requiredParameters": [
+              {
+                "data_type": "string",
+                "field": "id"
+              },
+              {
+                "data_type": "string",
+                "field": "email_address"
+              }
+            ],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "3",
+          "type": "action",
+          "warnings": {},
+          "x": 0,
+          "y": 686
+        },
+        "4": {
+          "data": {
+            "advanced": {
+              "customName": "email deletion observable",
+              "customNameId": 0,
+              "description": "Format a normalized output for each message_id and mailbox.",
+              "join": [],
+              "note": "Format a normalized output for each message_id and mailbox."
+            },
+            "functionId": 1,
+            "functionName": "email_deletion_observable",
+            "id": "4",
+            "inputParameters": [
+              "filtered-data:purge_filter:condition_1:purge_email:action_result.parameter.email_address",
+              "filtered-data:purge_filter:condition_1:purge_email:action_result.parameter.id",
+              "filtered-data:purge_filter:condition_1:purge_email:action_result.status",
+              "filtered-data:purge_filter:condition_1:purge_email:action_result.message"
+            ],
+            "outputVariables": [
+              "observable_array"
+            ],
+            "type": "code"
+          },
+          "errors": {},
+          "id": "4",
+          "type": "code",
+          "userCode": "    \n    email_address = filtered_result_0_parameter_email_address\n    message_id = filtered_result_0_parameter_id\n    result_status = filtered_result_0_status\n    result_message = filtered_result_0_message\n    \n    email_deletion_observable__observable_array = []\n    \n    for message_id, email, result, message in zip(message_id, email_address, result_status, result_message):\n        email_status = {\n            \"type\": \"Internet Message ID\",\n            \"source\": \"MS Graph for Office365\",\n            \"value\": message_id,\n            \"mailbox\": email,\n            \"message\": message,\n            \"status\": \"deleted\"\n        }\n\n        email_deletion_observable__observable_array.append(email_status)\n\n",
+          "warnings": {},
+          "x": 0,
+          "y": 1044
+        },
+        "6": {
+          "data": {
+            "advanced": {
+              "customName": "input_validation_filter",
+              "customNameId": 0,
+              "description": "Filter message_id and email inputs to route inputs to appropriate actions.",
+              "join": [],
+              "note": "Filter message_id and email inputs to route inputs to appropriate actions."
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:email",
+                    "value": ""
+                  },
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:message_id",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Inputs",
+                "logic": "and"
+              }
+            ],
+            "functionId": 1,
+            "functionName": "input_validation_filter",
+            "id": "6",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "6",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 148
+        },
+        "7": {
+          "data": {
+            "advanced": {
+              "customName": "filter run query",
+              "customNameId": 0,
+              "description": "filter check if the message is found in the mailbox.",
+              "join": [],
+              "note": "filter check if the message is found in the mailbox."
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": ">=",
+                    "param": "search_o365_for_email:action_result.summary.emails_matched",
+                    "value": "1"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Found email",
+                "logic": "and"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "filter_run_query",
+            "id": "7",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "7",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 506
+        },
+        "8": {
+          "data": {
+            "advanced": {
+              "customName": "purge filter",
+              "customNameId": 0,
+              "description": "filter check if the message is deleted from mailbox",
+              "join": [],
+              "note": "filter check if the message is deleted from mailbox"
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "==",
+                    "param": "purge_email:action_result.status",
+                    "value": "success"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Purge Success",
+                "logic": "and"
+              }
+            ],
+            "functionId": 3,
+            "functionName": "purge_filter",
+            "id": "8",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "8",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 860
+        }
+      },
+      "notes": "Inputs: internet message id, email\nInteractions: MS Graph for O365\nActions: Run Query, Delete Email\nOutputs: observables"
+    },
+    "input_spec": [
+      {
+        "contains": [
+          "internet message id",
+          "msgoffice365 internet message id"
+        ],
+        "description": "An Internet Message ID to search for",
+        "name": "message_id"
+      },
+      {
+        "contains": [
+          "email"
+        ],
+        "description": "An email address for a specific inbox",
+        "name": "email"
+      }
+    ],
+    "output_spec": [
+      {
+        "contains": [],
+        "datapaths": [
+          "email_deletion_observable:custom_function:observable_array"
+        ],
+        "deduplicate": false,
+        "description": "An array of observable dictionaries ",
+        "metadata": {},
+        "name": "observable"
+      }
+    ],
+    "playbook_type": "data",
+    "python_version": "3",
+    "schema": "5.0.11",
+    "version": "6.2.0.355"
+  },
+  "create_time": "2024-02-27T15:03:19.322053+00:00",
+  "draft_mode": false,
+  "labels": [
+    "*"
+  ],
+  "tags": [
+    "internet_message_id",
+    "ms_graph_for_o365",
+    "D3-ER",
+    "message_eviction",
+    "Office365"
+  ]
+}

playbooks/MS_Graph_for_Office_365_Message_Eviction.py

@@ -0,0 +1,245 @@
+"""
+Accepts message ID that needs to be evicted from provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message eviction.\n\nRef: D3-ER\nhttps://d3fend.mitre.org/technique/d3f:EmailRemoval/
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'input_validation_filter' block
+    input_validation_filter(container=container)
+
+    return
+
+@phantom.playbook_block()
+def search_o365_for_email(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("search_o365_for_email() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    ################################################################################
+    # Search for  provided message ID in provided mailbox from filtered playbook inputs.
+    ################################################################################
+
+    filtered_input_0_email = phantom.collect2(container=container, datapath=["filtered-data:input_validation_filter:condition_1:playbook_input:email"])
+    filtered_input_1_message_id = phantom.collect2(container=container, datapath=["filtered-data:input_validation_filter:condition_1:playbook_input:message_id"])
+
+    parameters = []
+
+    # build parameters list for 'search_o365_for_email' call
+    for filtered_input_0_email_item in filtered_input_0_email:
+        for filtered_input_1_message_id_item in filtered_input_1_message_id:
+            if filtered_input_0_email_item[0] is not None:
+                parameters.append({
+                    "folder": "Inbox",
+                    "email_address": filtered_input_0_email_item[0],
+                    "get_folder_id": True,
+                    "internet_message_id": filtered_input_1_message_id_item[0],
+                    "search_well_known_folders": True,
+                })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+    
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("run query", parameters=parameters, name="search_o365_for_email", assets=["ms_graph_for_office_365"], callback=filter_run_query)
+
+    return
+
+
+@phantom.playbook_block()
+def purge_email(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("purge_email() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    ################################################################################
+    # Remove  provided message ID in provided mailbox from filtered query outputs.
+    ################################################################################
+
+    filtered_result_0_data_filter_run_query = phantom.collect2(container=container, datapath=["filtered-data:filter_run_query:condition_1:search_o365_for_email:action_result.data.*.id","filtered-data:filter_run_query:condition_1:search_o365_for_email:action_result.parameter.email_address"])
+
+    parameters = []
+
+    # build parameters list for 'purge_email' call
+    for filtered_result_0_item_filter_run_query in filtered_result_0_data_filter_run_query:
+        if filtered_result_0_item_filter_run_query[0] is not None and filtered_result_0_item_filter_run_query[1] is not None:
+            parameters.append({
+                "id": filtered_result_0_item_filter_run_query[0],
+                "email_address": filtered_result_0_item_filter_run_query[1],
+            })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("delete email", parameters=parameters, name="purge_email", assets=["ms_graph_for_office_365"], callback=purge_filter)
+
+    return
+
+
+@phantom.playbook_block()
+def email_deletion_observable(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("email_deletion_observable() called")
+
+    ################################################################################
+    # Format a normalized output for each message_id and mailbox.
+    ################################################################################
+
+    filtered_result_0_data_purge_filter = phantom.collect2(container=container, datapath=["filtered-data:purge_filter:condition_1:purge_email:action_result.parameter.email_address","filtered-data:purge_filter:condition_1:purge_email:action_result.parameter.id","filtered-data:purge_filter:condition_1:purge_email:action_result.status","filtered-data:purge_filter:condition_1:purge_email:action_result.message"])
+
+    filtered_result_0_parameter_email_address = [item[0] for item in filtered_result_0_data_purge_filter]
+    filtered_result_0_parameter_id = [item[1] for item in filtered_result_0_data_purge_filter]
+    filtered_result_0_status = [item[2] for item in filtered_result_0_data_purge_filter]
+    filtered_result_0_message = [item[3] for item in filtered_result_0_data_purge_filter]
+
+    email_deletion_observable__observable_array = None
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+    
+    email_address = filtered_result_0_parameter_email_address
+    message_id = filtered_result_0_parameter_id
+    result_status = filtered_result_0_status
+    result_message = filtered_result_0_message
+    
+    email_deletion_observable__observable_array = []
+    
+    for message_id, email, result, message in zip(message_id, email_address, result_status, result_message):
+        email_status = {
+            "type": "Internet Message ID",
+            "source": "MS Graph for Office365",
+            "value": message_id,
+            "mailbox": email,
+            "message": message,
+            "status": "deleted"
+        }
+
+        email_deletion_observable__observable_array.append(email_status)
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_run_data(key="email_deletion_observable:observable_array", value=json.dumps(email_deletion_observable__observable_array))
+
+    return
+
+
+@phantom.playbook_block()
+def input_validation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_validation_filter() called")
+
+    ################################################################################
+    # Filter message_id and email inputs to route inputs to appropriate actions.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        logical_operator="and",
+        conditions=[
+            ["playbook_input:email", "!=", ""],
+            ["playbook_input:message_id", "!=", ""]
+        ],
+        name="input_validation_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        search_o365_for_email(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def filter_run_query(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("filter_run_query() called")
+
+    ################################################################################
+    # filter check if the message is found in the mailbox.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["search_o365_for_email:action_result.summary.emails_matched", ">=", 1]
+        ],
+        name="filter_run_query:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        purge_email(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def purge_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("purge_filter() called")
+
+    ################################################################################
+    # filter check if the message is deleted from mailbox
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["purge_email:action_result.status", "==", "success"]
+        ],
+        name="purge_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        email_deletion_observable(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    email_deletion_observable__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="email_deletion_observable:observable_array")) != "" else "null")  # pylint: disable=used-before-assignment
+
+    output = {
+        "observable": email_deletion_observable__observable_array,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_playbook_output_data(output=output)
+
+    return

playbooks/MS_Graph_for_Office_365_Message_Eviction.yml

@@ -0,0 +1,25 @@
+name: MS Graph for Office 365 Message Eviction
+id: 5299d6dd-e9c4-4bfd-b031-928acd1ff816
+version: 1
+date: '2024-01-21'
+author: Lou Stella, Splunk
+type: Response
+description: Accepts message ID that needs to be evicted from provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message eviction.
+playbook: MS_Graph_for_Office_365_Message_Eviction
+how_to_implement: This input playbook requires the MS Graph for Office 365 connector to be configured.  
+references: []
+app_list: 
+  - MS Graph for Office 365
+tags:
+  platform_tags:
+    - message_eviction 
+    - internet_message_id
+    - ms_graph_for_o365
+  playbook_type: Input
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: D3-ER

playbooks/MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.json

@@ -0,0 +1,387 @@
+{
+  "blockly": false,
+  "blockly_xml": "<xml></xml>",
+  "category": "Message Identifier Activity Analysis",
+  "coa": {
+    "data": {
+      "description": "Caution: This may run into performance or rate limiting issues at large scale because each mailbox is checked individually.\n\nAccepts an internet message id, and asks Office365 for a list of mailboxes to search, and then searches each one to look for records that have a matching internet message id.  It then produces a normalized output and summary table.\n\nRef: D3-IAA: https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis/",
+      "edges": [
+        {
+          "id": "port_0_to_port_2",
+          "sourceNode": "0",
+          "sourcePort": "0_out",
+          "targetNode": "2",
+          "targetPort": "2_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_2_to_port_3",
+          "sourceNode": "2",
+          "sourcePort": "2_out",
+          "targetNode": "3",
+          "targetPort": "3_in"
+        },
+        {
+          "id": "port_3_to_port_4",
+          "sourceNode": "3",
+          "sourcePort": "3_out",
+          "targetNode": "4",
+          "targetPort": "4_in"
+        },
+        {
+          "id": "port_4_to_port_5",
+          "sourceNode": "4",
+          "sourcePort": "4_out",
+          "targetNode": "5",
+          "targetPort": "5_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_5_to_port_6",
+          "sourceNode": "5",
+          "sourcePort": "5_out",
+          "targetNode": "6",
+          "targetPort": "6_in"
+        },
+        {
+          "id": "port_6_to_port_7",
+          "sourceNode": "6",
+          "sourcePort": "6_out",
+          "targetNode": "7",
+          "targetPort": "7_in"
+        },
+        {
+          "id": "port_7_to_port_1",
+          "sourceNode": "7",
+          "sourcePort": "7_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        }
+      ],
+      "hash": "45d4a584a4ca07264994c6fc3fe8286338ad5d6c",
+      "nodes": {
+        "0": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_start",
+            "id": "0",
+            "type": "start"
+          },
+          "errors": {},
+          "id": "0",
+          "type": "start",
+          "warnings": {},
+          "x": 1000,
+          "y": 419.99999999999943
+        },
+        "1": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_finish",
+            "id": "1",
+            "type": "end"
+          },
+          "errors": {},
+          "id": "1",
+          "type": "end",
+          "warnings": {},
+          "x": 1000,
+          "y": 1420
+        },
+        "2": {
+          "data": {
+            "advanced": {
+              "customName": "artifact filter",
+              "customNameId": 0,
+              "join": []
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:message_id",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Valid Input",
+                "logic": "and"
+              }
+            ],
+            "functionId": 1,
+            "functionName": "artifact_filter",
+            "id": "2",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "2",
+          "type": "filter",
+          "warnings": {},
+          "x": 1050,
+          "y": 544.5
+        },
+        "3": {
+          "data": {
+            "action": "list users",
+            "actionType": "investigate",
+            "advanced": {
+              "customName": "get mailboxes",
+              "customNameId": 0,
+              "description": "Currently a required step in order to search \"All\" of the mailboxes in an O365 tenant. This receives a list of mailboxes that are passed to the next action.",
+              "join": [],
+              "note": "Gets a list of mailboxes from O365 to search"
+            },
+            "connector": "MS Graph for Office 365",
+            "connectorConfigs": [
+              "ms_graph_for_office_365"
+            ],
+            "connectorId": "0a0a4087-10e8-4c96-9872-b740ff26d8bb",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "get_mailboxes",
+            "id": "3",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {},
+            "requiredParameters": [],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "3",
+          "type": "action",
+          "warnings": {},
+          "x": 980,
+          "y": 704.5
+        },
+        "4": {
+          "data": {
+            "action": "run query",
+            "actionType": "investigate",
+            "advanced": {
+              "customName": "search mailboxes",
+              "customNameId": 0,
+              "join": [],
+              "note": "Searches mailboxes returned by the previous action for messages with an internet message ID matching the input"
+            },
+            "connector": "MS Graph for Office 365",
+            "connectorConfigs": [
+              "ms_graph_for_office_365"
+            ],
+            "connectorId": "0a0a4087-10e8-4c96-9872-b740ff26d8bb",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "search_mailboxes",
+            "id": "4",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "email_address": "get_mailboxes:action_result.data.*.mail",
+              "folder": "Inbox",
+              "get_folder_id": true,
+              "internet_message_id": "filtered-data:artifact_filter:condition_1:playbook_input:message_id",
+              "search_well_known_folders": true
+            },
+            "requiredParameters": [
+              {
+                "data_type": "string",
+                "default": "Inbox",
+                "field": "folder"
+              },
+              {
+                "data_type": "string",
+                "field": "email_address"
+              },
+              {
+                "data_type": "boolean",
+                "default": true,
+                "field": "get_folder_id"
+              }
+            ],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "4",
+          "type": "action",
+          "warnings": {},
+          "x": 980,
+          "y": 840
+        },
+        "5": {
+          "data": {
+            "advanced": {
+              "customName": "results filter",
+              "customNameId": 0,
+              "description": "Filter results from mailbox search",
+              "join": [],
+              "note": "Remove mailboxes that couldn't be searched or where no results were found"
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "==",
+                    "param": "search_mailboxes:action_result.status",
+                    "value": "success"
+                  },
+                  {
+                    "op": ">",
+                    "param": "search_mailboxes:action_result.summary.emails_matched",
+                    "value": "0"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Results Found",
+                "logic": "and"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "results_filter",
+            "id": "5",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "5",
+          "type": "filter",
+          "warnings": {},
+          "x": 1040,
+          "y": 964.5
+        },
+        "6": {
+          "data": {
+            "advanced": {
+              "customName": "format message report",
+              "customNameId": 0,
+              "join": [],
+              "note": "Format the markdown table summary of this playbook execution"
+            },
+            "functionId": 1,
+            "functionName": "format_message_report",
+            "id": "6",
+            "parameters": [
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.toRecipients.*.emailAddress.address",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.sender.emailAddress.address",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject"
+            ],
+            "template": "SOAR searched for occurrences of `{0}` within your environment using MS Graph for O365. The table below shows a summary of the information gathered.\n\n| Recipient | Sender | Subject |\n| --- | --- | --- | --- |\n%%\n| {1} | {2} | {3} |\n%%\n",
+            "type": "format"
+          },
+          "errors": {},
+          "id": "6",
+          "type": "format",
+          "warnings": {},
+          "x": 980,
+          "y": 1140
+        },
+        "7": {
+          "data": {
+            "advanced": {
+              "customName": "build message output",
+              "customNameId": 0,
+              "description": "Logic regarding observable construction goes here",
+              "join": [],
+              "note": "Format the observable output object produced by this playbook"
+            },
+            "functionId": 1,
+            "functionName": "build_message_output",
+            "id": "7",
+            "inputParameters": [
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.email_address",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.sender.emailAddress.address",
+              "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.id"
+            ],
+            "outputVariables": [
+              "observable_array"
+            ],
+            "type": "code"
+          },
+          "errors": {},
+          "id": "7",
+          "type": "code",
+          "userCode": "\n    internet_message_ids = filtered_result_0_parameter_internet_message_id\n    mailboxes = filtered_result_0_parameter_email_address\n    subjects = filtered_result_0_data___subject\n    senders = filtered_result_0_data___sender_emailaddress_address\n    office365_ids = filtered_result_0_data___id\n    \n    build_message_output__observable_array = []\n    \n    for internet_message_id, recipient_address, subject, sender, office365_id in zip(internet_message_ids, mailboxes, subjects, senders, office365_ids):\n        record = {\n            \"subject\": subject,\n            \"sender\": sender,\n            \"recipient\": recipient_address,\n            \"o365_id\": office365_id,\n            \"value\": internet_message_id,\n            \"type\": \"internet message id\",\n            \"source\": \"MS Graph for Office365\"\n        }\n        \n        \n        \n        build_message_output__observable_array.append(record)\n    \n    \n\n",
+          "warnings": {},
+          "x": 1000,
+          "y": 1280
+        }
+      },
+      "notes": "Inputs: internet message id\nInteractions: MS Graph for Office 365\nActions: list users, run query\nOutputs: observable, markdown report"
+    },
+    "input_spec": [
+      {
+        "contains": [
+          "internet message id"
+        ],
+        "description": "An Internet Message ID to look for within an O365 environment",
+        "name": "message_id"
+      }
+    ],
+    "output_spec": [
+      {
+        "contains": [],
+        "datapaths": [
+          "build_message_output:custom_function:observable_array"
+        ],
+        "deduplicate": false,
+        "description": "An array of Observable objects ",
+        "metadata": {},
+        "name": "observables"
+      },
+      {
+        "contains": [],
+        "datapaths": [
+          "format_message_report:formatted_data"
+        ],
+        "deduplicate": false,
+        "description": "An array of markdown reports",
+        "metadata": {},
+        "name": "markdown_report"
+      }
+    ],
+    "playbook_type": "data",
+    "python_version": "3",
+    "schema": "5.0.11",
+    "version": "6.2.0.355"
+  },
+  "create_time": "2024-02-27T22:20:23.617239+00:00",
+  "draft_mode": false,
+  "labels": [
+    "*"
+  ],
+  "tags": [
+    "message_identifier_activity",
+    "internet_message_id",
+    "D3-IAA",
+    "ms_graph_for_o365"
+  ]
+}

playbooks/MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.py

@@ -0,0 +1,244 @@
+"""
+Caution: This may run into performance or rate limiting issues at large scale because each mailbox is checked individually.\n\nAccepts an internet message id, and asks Office365 for a list of mailboxes to search, and then searches each one to look for records that have a matching internet message id.  It then produces a normalized output and summary table.\n\nRef: D3-IAA: https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis/
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'artifact_filter' block
+    artifact_filter(container=container)
+
+    return
+
+@phantom.playbook_block()
+def artifact_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("artifact_filter() called")
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["playbook_input:message_id", "!=", ""]
+        ],
+        name="artifact_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        get_mailboxes(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def get_mailboxes(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("get_mailboxes() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    ################################################################################
+    # Currently a required step in order to search "All" of the mailboxes in an O365 
+    # tenant. This receives a list of mailboxes that are passed to the next action.
+    ################################################################################
+
+    parameters = []
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("list users", parameters=parameters, name="get_mailboxes", assets=["ms_graph_for_office_365"], callback=search_mailboxes)
+
+    return
+
+
+@phantom.playbook_block()
+def search_mailboxes(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("search_mailboxes() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    get_mailboxes_result_data = phantom.collect2(container=container, datapath=["get_mailboxes:action_result.data.*.mail","get_mailboxes:action_result.parameter.context.artifact_id"], action_results=results)
+    filtered_input_0_message_id = phantom.collect2(container=container, datapath=["filtered-data:artifact_filter:condition_1:playbook_input:message_id"])
+
+    parameters = []
+
+    # build parameters list for 'search_mailboxes' call
+    for get_mailboxes_result_item in get_mailboxes_result_data:
+        for filtered_input_0_message_id_item in filtered_input_0_message_id:
+            if get_mailboxes_result_item[0] is not None:
+                parameters.append({
+                    "folder": "Inbox",
+                    "email_address": get_mailboxes_result_item[0],
+                    "get_folder_id": True,
+                    "internet_message_id": filtered_input_0_message_id_item[0],
+                    "search_well_known_folders": True,
+                    "context": {'artifact_id': get_mailboxes_result_item[1]},
+                })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("run query", parameters=parameters, name="search_mailboxes", assets=["ms_graph_for_office_365"], callback=results_filter)
+
+    return
+
+
+@phantom.playbook_block()
+def results_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("results_filter() called")
+
+    ################################################################################
+    # Filter results from mailbox search
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        logical_operator="and",
+        conditions=[
+            ["search_mailboxes:action_result.status", "==", "success"],
+            ["search_mailboxes:action_result.summary.emails_matched", ">", 0]
+        ],
+        name="results_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        format_message_report(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def format_message_report(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("format_message_report() called")
+
+    template = """SOAR searched for occurrences of `{0}` within your environment using MS Graph for O365. The table below shows a summary of the information gathered.\n\n| Recipient | Sender | Subject |\n| --- | --- | --- | --- |\n%%\n| {1} | {2} | {3} |\n%%\n"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id",
+        "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.toRecipients.*.emailAddress.address",
+        "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.sender.emailAddress.address",
+        "filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject"
+    ]
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_message_report")
+
+    build_message_output(container=container)
+
+    return
+
+
+@phantom.playbook_block()
+def build_message_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("build_message_output() called")
+
+    ################################################################################
+    # Logic regarding observable construction goes here
+    ################################################################################
+
+    filtered_result_0_data_results_filter = phantom.collect2(container=container, datapath=["filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.internet_message_id","filtered-data:results_filter:condition_1:search_mailboxes:action_result.parameter.email_address","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.subject","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.sender.emailAddress.address","filtered-data:results_filter:condition_1:search_mailboxes:action_result.data.*.id"])
+
+    filtered_result_0_parameter_internet_message_id = [item[0] for item in filtered_result_0_data_results_filter]
+    filtered_result_0_parameter_email_address = [item[1] for item in filtered_result_0_data_results_filter]
+    filtered_result_0_data___subject = [item[2] for item in filtered_result_0_data_results_filter]
+    filtered_result_0_data___sender_emailaddress_address = [item[3] for item in filtered_result_0_data_results_filter]
+    filtered_result_0_data___id = [item[4] for item in filtered_result_0_data_results_filter]
+
+    build_message_output__observable_array = None
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    internet_message_ids = filtered_result_0_parameter_internet_message_id
+    mailboxes = filtered_result_0_parameter_email_address
+    subjects = filtered_result_0_data___subject
+    senders = filtered_result_0_data___sender_emailaddress_address
+    office365_ids = filtered_result_0_data___id
+    
+    build_message_output__observable_array = []
+    
+    for internet_message_id, recipient_address, subject, sender, office365_id in zip(internet_message_ids, mailboxes, subjects, senders, office365_ids):
+        record = {
+            "subject": subject,
+            "sender": sender,
+            "recipient": recipient_address,
+            "o365_id": office365_id,
+            "value": internet_message_id,
+            "type": "internet message id",
+            "source": "MS Graph for Office365"
+        }
+        
+        
+        
+        build_message_output__observable_array.append(record)
+    
+    
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_run_data(key="build_message_output:observable_array", value=json.dumps(build_message_output__observable_array))
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    format_message_report = phantom.get_format_data(name="format_message_report")
+    build_message_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_message_output:observable_array")) != "" else "null")  # pylint: disable=used-before-assignment
+
+    output = {
+        "observables": build_message_output__observable_array,
+        "markdown_report": format_message_report,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_playbook_output_data(output=output)
+
+    return

playbooks/MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.yml

@@ -0,0 +1,25 @@
+name: MS Graph for Office 365 Message Identifier Activity Analysis
+id: 5292d6ad-e9c4-4bfd-b831-928ac1dff816
+version: 1
+date: '2024-02-03'
+author: Lou Stella, Splunk
+type: Investigation
+description: "Accepts an internet message id, and asks Microsoft for a list of users with mailboxes to search, and then searches each one to look for records that have a matching internet message id.  It then produces a normalized output and summary table."
+playbook: MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis
+how_to_implement: This input playbook requires the MS Graph for Office 365 connector to be configured.  
+references: []
+app_list: 
+  - MS Graph for Office 365
+tags:
+  platform_tags:
+    - message_identifier_activity 
+    - internet_message_id
+    - ms_graph_for_o365
+  playbook_type: Input
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: D3-IAA

playbooks/MS_Graph_for_Office_365_Message_Restore.json

@@ -0,0 +1,424 @@
+{
+  "blockly": false,
+  "blockly_xml": "<xml></xml>",
+  "category": "Message Restoration",
+  "coa": {
+    "data": {
+      "description": "Accepts message ID that needs to be restored to the provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message restoration.\n\nRef: D3-RE:\nhttps://d3fend.mitre.org/technique/d3f:RestoreEmail/",
+      "edges": [
+        {
+          "id": "port_4_to_port_1",
+          "sourceNode": "4",
+          "sourcePort": "4_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        },
+        {
+          "id": "port_0_to_port_5",
+          "sourceNode": "0",
+          "sourcePort": "0_out",
+          "targetNode": "5",
+          "targetPort": "5_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_5_to_port_2",
+          "sourceNode": "5",
+          "sourcePort": "5_out",
+          "targetNode": "2",
+          "targetPort": "2_in"
+        },
+        {
+          "id": "port_2_to_port_6",
+          "sourceNode": "2",
+          "sourcePort": "2_out",
+          "targetNode": "6",
+          "targetPort": "6_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_6_to_port_3",
+          "sourceNode": "6",
+          "sourcePort": "6_out",
+          "targetNode": "3",
+          "targetPort": "3_in"
+        },
+        {
+          "id": "port_3_to_port_7",
+          "sourceNode": "3",
+          "sourcePort": "3_out",
+          "targetNode": "7",
+          "targetPort": "7_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_7_to_port_4",
+          "sourceNode": "7",
+          "sourcePort": "7_out",
+          "targetNode": "4",
+          "targetPort": "4_in"
+        }
+      ],
+      "hash": "ee2addb1fbfc9330b8d1b1809380c85119771803",
+      "nodes": {
+        "0": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_start",
+            "id": "0",
+            "type": "start"
+          },
+          "errors": {},
+          "id": "0",
+          "type": "start",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": -6.394884621840902e-14
+        },
+        "1": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_finish",
+            "id": "1",
+            "type": "end"
+          },
+          "errors": {},
+          "id": "1",
+          "type": "end",
+          "warnings": {},
+          "x": 19.999999999999986,
+          "y": 1132
+        },
+        "2": {
+          "data": {
+            "action": "run query",
+            "actionType": "investigate",
+            "advanced": {
+              "customName": "search o365 for email",
+              "customNameId": 0,
+              "description": "Search for  provided message ID in provided mailbox from filtered playbook inputs.",
+              "join": [],
+              "note": "Search for  provided message ID in provided mailbox from filtered playbook inputs."
+            },
+            "connector": "MS Graph for Office 365",
+            "connectorConfigs": [
+              "ms_graph_for_office_365"
+            ],
+            "connectorId": "0a0a4087-10e8-4c96-9872-b740ff26d8bb",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "search_o365_for_email",
+            "id": "2",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "email_address": "filtered-data:input_validation_filter:condition_1:playbook_input:email",
+              "folder": "recoverableitemsdeletions",
+              "get_folder_id": false,
+              "internet_message_id": "filtered-data:input_validation_filter:condition_1:playbook_input:message_id"
+            },
+            "requiredParameters": [
+              {
+                "data_type": "string",
+                "default": "Inbox",
+                "field": "folder"
+              },
+              {
+                "data_type": "string",
+                "field": "email_address"
+              },
+              {
+                "data_type": "boolean",
+                "default": true,
+                "field": "get_folder_id"
+              }
+            ],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "2",
+          "type": "action",
+          "warnings": {},
+          "x": 0,
+          "y": 328
+        },
+        "3": {
+          "data": {
+            "action": "move email",
+            "actionType": "generic",
+            "advanced": {
+              "customName": "restore email",
+              "customNameId": 0,
+              "description": "Restore  provided message ID in provided mailbox from filtered query outputs.",
+              "join": [],
+              "note": "Restore  provided message ID in provided mailbox from filtered query outputs."
+            },
+            "connector": "MS Graph for Office 365",
+            "connectorConfigs": [
+              "ms_graph_for_office_365"
+            ],
+            "connectorId": "0a0a4087-10e8-4c96-9872-b740ff26d8bb",
+            "connectorVersion": "v1",
+            "functionId": 1,
+            "functionName": "restore_email",
+            "id": "3",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "parameters": {
+              "email_address": "search_o365_for_email:action_result.parameter.email_address",
+              "folder": "Inbox",
+              "get_folder_id": true,
+              "id": "filtered-data:filter_run_query:condition_1:search_o365_for_email:action_result.data.*.id"
+            },
+            "requiredParameters": [
+              {
+                "data_type": "string",
+                "field": "id"
+              },
+              {
+                "data_type": "string",
+                "field": "folder"
+              },
+              {
+                "data_type": "string",
+                "field": "email_address"
+              },
+              {
+                "data_type": "boolean",
+                "default": true,
+                "field": "get_folder_id"
+              }
+            ],
+            "type": "action"
+          },
+          "errors": {},
+          "id": "3",
+          "type": "action",
+          "warnings": {},
+          "x": 0,
+          "y": 656
+        },
+        "4": {
+          "data": {
+            "advanced": {
+              "customName": "email restore observable",
+              "customNameId": 0,
+              "description": "Format a normalized output for each message_id and mailbox.",
+              "join": [],
+              "note": "Format a normalized output for each message_id and mailbox."
+            },
+            "functionId": 1,
+            "functionName": "email_restore_observable",
+            "id": "4",
+            "inputParameters": [
+              "filtered-data:restore_filter:condition_1:restore_email:action_result.parameter.email_address",
+              "filtered-data:restore_filter:condition_1:restore_email:action_result.parameter.id",
+              "filtered-data:restore_filter:condition_1:restore_email:action_result.status",
+              "filtered-data:restore_filter:condition_1:restore_email:action_result.message"
+            ],
+            "outputVariables": [
+              "observable_array"
+            ],
+            "type": "code"
+          },
+          "errors": {},
+          "id": "4",
+          "type": "code",
+          "userCode": "\n    email_address = filtered_result_0_parameter_email_address\n    message_id = filtered_result_0_parameter_id\n    result_status = filtered_result_0_status\n    result_message = filtered_result_0_message\n    \n    email_restore_observable__observable_array = []\n    \n    for message_id, email, result, message in zip(message_id, email_address, result_status, result_message):\n        email_status = {\n            \"type\": \"Internet Message ID\",\n            \"source\": \"MS Graph for Office365\",\n            \"value\": message_id,\n            \"mailbox\": email,\n            \"message\": message,\n            \"status\": \"restored\"\n        }\n        \n        email_restore_observable__observable_array.append(email_status)\n\n",
+          "warnings": {},
+          "x": 0,
+          "y": 984
+        },
+        "5": {
+          "data": {
+            "advanced": {
+              "customName": "input_validation_filter",
+              "customNameId": 0,
+              "description": "Filter message_id and email inputs to route inputs to appropriate actions.",
+              "join": [],
+              "note": "Filter message_id and email inputs to route inputs to appropriate actions."
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:message_id",
+                    "value": ""
+                  },
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_input:email",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "inputs",
+                "logic": "and"
+              }
+            ],
+            "functionId": 1,
+            "functionName": "input_validation_filter",
+            "id": "5",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "5",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 140
+        },
+        "6": {
+          "data": {
+            "advanced": {
+              "customName": "filter run query",
+              "customNameId": 0,
+              "description": "filter check if the message is found in the mailbox.",
+              "join": [],
+              "note": "filter check if the message is found in the mailbox."
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": ">=",
+                    "param": "search_o365_for_email:action_result.summary.emails_matched",
+                    "value": "1"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Found Email",
+                "logic": "and"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "filter_run_query",
+            "id": "6",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "6",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 480
+        },
+        "7": {
+          "data": {
+            "advanced": {
+              "customName": "restore filter",
+              "customNameId": 0,
+              "description": "filter check if the message is restored in the mailbox.",
+              "join": [],
+              "note": "filter check if the message is restored in the mailbox."
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "==",
+                    "param": "restore_email:action_result.status",
+                    "value": "success"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "Move Success",
+                "logic": "and"
+              }
+            ],
+            "functionId": 3,
+            "functionName": "restore_filter",
+            "id": "7",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "7",
+          "type": "filter",
+          "warnings": {},
+          "x": 60,
+          "y": 804
+        }
+      },
+      "notes": "Inputs: internet message id, email\nInteractions: MS Graph for O365\nActions: Run Query, Move Email\nOutputs: observables"
+    },
+    "input_spec": [
+      {
+        "contains": [
+          "internet message id"
+        ],
+        "description": "An Internet Message ID to attempt to restore",
+        "name": "message_id"
+      },
+      {
+        "contains": [
+          "email"
+        ],
+        "description": "An Email Mailbox that contains the message ID",
+        "name": "email"
+      }
+    ],
+    "output_spec": [
+      {
+        "contains": [],
+        "datapaths": [
+          "email_restore_observable:custom_function:observable_array"
+        ],
+        "deduplicate": false,
+        "description": "An array of observable dictionaries ",
+        "metadata": {},
+        "name": "observables"
+      }
+    ],
+    "playbook_type": "data",
+    "python_version": "3",
+    "schema": "5.0.11",
+    "version": "6.2.0.355"
+  },
+  "create_time": "2024-02-28T18:41:48.011798+00:00",
+  "draft_mode": false,
+  "labels": [
+    "*"
+  ],
+  "tags": [
+    "D3-RE",
+    "ms_graph_for_o365",
+    "internet_message_id",
+    "email",
+    "Office365"
+  ]
+}

playbooks/MS_Graph_for_Office_365_Message_Restore.py

@@ -0,0 +1,248 @@
+"""
+Accepts message ID that needs to be restored to the provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message restoration.\n\nRef: D3-RE:\nhttps://d3fend.mitre.org/technique/d3f:RestoreEmail/
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'input_validation_filter' block
+    input_validation_filter(container=container)
+
+    return
+
+@phantom.playbook_block()
+def search_o365_for_email(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("search_o365_for_email() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    ################################################################################
+    # Search for  provided message ID in provided mailbox from filtered playbook inputs.
+    ################################################################################
+
+    filtered_input_0_email = phantom.collect2(container=container, datapath=["filtered-data:input_validation_filter:condition_1:playbook_input:email"])
+    filtered_input_1_message_id = phantom.collect2(container=container, datapath=["filtered-data:input_validation_filter:condition_1:playbook_input:message_id"])
+
+    parameters = []
+
+    # build parameters list for 'search_o365_for_email' call
+    for filtered_input_0_email_item in filtered_input_0_email:
+        for filtered_input_1_message_id_item in filtered_input_1_message_id:
+            if filtered_input_0_email_item[0] is not None:
+                parameters.append({
+                    "folder": "recoverableitemsdeletions",
+                    "email_address": filtered_input_0_email_item[0],
+                    "get_folder_id": False,
+                    "internet_message_id": filtered_input_1_message_id_item[0],
+                })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("run query", parameters=parameters, name="search_o365_for_email", assets=["ms_graph_for_office_365"], callback=filter_run_query)
+
+    return
+
+
+@phantom.playbook_block()
+def restore_email(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("restore_email() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    ################################################################################
+    # Restore  provided message ID in provided mailbox from filtered query outputs.
+    ################################################################################
+
+    filtered_result_0_data_filter_run_query = phantom.collect2(container=container, datapath=["filtered-data:filter_run_query:condition_1:search_o365_for_email:action_result.data.*.id"])
+    search_o365_for_email_result_data = phantom.collect2(container=container, datapath=["search_o365_for_email:action_result.parameter.email_address","search_o365_for_email:action_result.parameter.context.artifact_id"], action_results=results)
+
+    parameters = []
+
+    # build parameters list for 'restore_email' call
+    for filtered_result_0_item_filter_run_query in filtered_result_0_data_filter_run_query:
+        for search_o365_for_email_result_item in search_o365_for_email_result_data:
+            if filtered_result_0_item_filter_run_query[0] is not None and search_o365_for_email_result_item[0] is not None:
+                parameters.append({
+                    "id": filtered_result_0_item_filter_run_query[0],
+                    "folder": "Inbox",
+                    "email_address": search_o365_for_email_result_item[0],
+                    "get_folder_id": True,
+                    "context": {'artifact_id': search_o365_for_email_result_item[1]},
+                })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("move email", parameters=parameters, name="restore_email", assets=["ms_graph_for_office_365"], callback=restore_filter)
+
+    return
+
+
+@phantom.playbook_block()
+def email_restore_observable(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("email_restore_observable() called")
+
+    ################################################################################
+    # Format a normalized output for each message_id and mailbox.
+    ################################################################################
+
+    filtered_result_0_data_restore_filter = phantom.collect2(container=container, datapath=["filtered-data:restore_filter:condition_1:restore_email:action_result.parameter.email_address","filtered-data:restore_filter:condition_1:restore_email:action_result.parameter.id","filtered-data:restore_filter:condition_1:restore_email:action_result.status","filtered-data:restore_filter:condition_1:restore_email:action_result.message"])
+
+    filtered_result_0_parameter_email_address = [item[0] for item in filtered_result_0_data_restore_filter]
+    filtered_result_0_parameter_id = [item[1] for item in filtered_result_0_data_restore_filter]
+    filtered_result_0_status = [item[2] for item in filtered_result_0_data_restore_filter]
+    filtered_result_0_message = [item[3] for item in filtered_result_0_data_restore_filter]
+
+    email_restore_observable__observable_array = None
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    email_address = filtered_result_0_parameter_email_address
+    message_id = filtered_result_0_parameter_id
+    result_status = filtered_result_0_status
+    result_message = filtered_result_0_message
+    
+    email_restore_observable__observable_array = []
+    
+    for message_id, email, result, message in zip(message_id, email_address, result_status, result_message):
+        email_status = {
+            "type": "Internet Message ID",
+            "source": "MS Graph for Office365",
+            "value": message_id,
+            "mailbox": email,
+            "message": message,
+            "status": "restored"
+        }
+        
+        email_restore_observable__observable_array.append(email_status)
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_run_data(key="email_restore_observable:observable_array", value=json.dumps(email_restore_observable__observable_array))
+
+    return
+
+
+@phantom.playbook_block()
+def input_validation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_validation_filter() called")
+
+    ################################################################################
+    # Filter message_id and email inputs to route inputs to appropriate actions.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        logical_operator="and",
+        conditions=[
+            ["playbook_input:message_id", "!=", ""],
+            ["playbook_input:email", "!=", ""]
+        ],
+        name="input_validation_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        search_o365_for_email(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def filter_run_query(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("filter_run_query() called")
+
+    ################################################################################
+    # filter check if the message is found in the mailbox.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["search_o365_for_email:action_result.summary.emails_matched", ">=", 1]
+        ],
+        name="filter_run_query:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        restore_email(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def restore_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("restore_filter() called")
+
+    ################################################################################
+    # filter check if the message is restored in the mailbox.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["restore_email:action_result.status", "==", "success"]
+        ],
+        name="restore_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        email_restore_observable(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    email_restore_observable__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="email_restore_observable:observable_array")) != "" else "null")  # pylint: disable=used-before-assignment
+
+    output = {
+        "observables": email_restore_observable__observable_array,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_playbook_output_data(output=output)
+
+    return

playbooks/MS_Graph_for_Office_365_Message_Restore.yml

@@ -0,0 +1,26 @@
+name: MS Graph for Office 365 Message Restore
+id: 5299d6dd-e9c4-4bad-b041-928ace1ff811
+version: 1
+date: '2024-02-15'
+author: Lou Stella, Splunk
+type: Response
+description: Accepts message ID that needs to be restored to the provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message restoration.
+playbook: MS_Graph_for_Office_365_Message_Restore
+how_to_implement: This input playbook requires the MS Graph for Office 365 connector to be configured.  
+references: []
+app_list: 
+  - MS Graph for Office 365
+tags:
+  platform_tags:
+    - message_restore 
+    - internet_message_id
+    - email
+    - ms_graph_for_o365
+  playbook_type: Input
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: D3-RE

playbooks/MS_Graph_for_Office_365_Search_and_Purge.py

@@ -0,0 +1,452 @@
+"""
+Accepts an Internet Message ID, searches for its presence in each mailbox, and then deletes the ones it finds. The Message Eviction playbook performs a "soft delete", which allows for messages to be recovered.
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'input_decision' block
+    input_decision(container=container)
+
+    return
+
+@phantom.playbook_block()
+def playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1() called")
+
+    filtered_artifact_0_data_input_filter = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_1:artifact:*.cef.internet message id"])
+
+    filtered_artifact_0__cef_internet_message_id = [item[0] for item in filtered_artifact_0_data_input_filter]
+
+    inputs = {
+        "message_id": filtered_artifact_0__cef_internet_message_id,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    # call playbook "local/MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis", returns the playbook_run_id
+    playbook_run_id = phantom.playbook("local/MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis", container=container, name="playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1", callback=identifier_filter, inputs=inputs)
+
+    return
+
+
+@phantom.playbook_block()
+def artifact_does_not_exist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("artifact_does_not_exist() called")
+
+    ################################################################################
+    # In the event an artifact does not exist suitable for this usecase, inform the 
+    # user.
+    ################################################################################
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.comment(container=container, comment="\"No Internet Message ID artifacts found\"")
+
+    return
+
+
+@phantom.playbook_block()
+def identifier_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("identifier_filter() called")
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1:playbook_output:observables", "!=", None]
+        ],
+        name="identifier_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        format_prompt(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    # collect filtered artifact ids and results for 'if' condition 2
+    matched_artifacts_2, matched_results_2 = phantom.condition(
+        container=container,
+        conditions=[
+            ["playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1:playbook_output:observables", "==", None]
+        ],
+        name="identifier_filter:condition_2",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_2 or matched_results_2:
+        no_observable_found(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)
+
+    return
+
+
+@phantom.playbook_block()
+def playbook_ms_graph_for_office_365_message_eviction_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("playbook_ms_graph_for_office_365_message_eviction_1() called")
+
+    filtered_output_0_playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1_output_observables = phantom.collect2(container=container, datapath=["filtered-data:identifier_filter:condition_1:playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1:playbook_output:observables.recipient","filtered-data:identifier_filter:condition_1:playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1:playbook_output:observables.value"])
+
+    filtered_output_0_playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1_output_observables_recipient = [item[0] for item in filtered_output_0_playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1_output_observables]
+    filtered_output_0_playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1_output_observables_value = [item[1] for item in filtered_output_0_playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1_output_observables]
+
+    inputs = {
+        "email": filtered_output_0_playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1_output_observables_recipient,
+        "message_id": filtered_output_0_playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1_output_observables_value,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    # call playbook "local/MS_Graph_for_Office_365_Message_Eviction", returns the playbook_run_id
+    playbook_run_id = phantom.playbook("local/MS_Graph_for_Office_365_Message_Eviction", container=container, name="playbook_ms_graph_for_office_365_message_eviction_1", callback=format_note, inputs=inputs)
+
+    return
+
+
+@phantom.playbook_block()
+def no_observable_found(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("no_observable_found() called")
+
+    ################################################################################
+    # In the event the Message Identifier Activity Analysis playbook does not return 
+    # an observable, inform the user.
+    ################################################################################
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.comment(container=container, comment="No observable output found for dispatched playbook.")
+
+    return
+
+
+@phantom.playbook_block()
+def format_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("format_note() called")
+
+    ################################################################################
+    # Format the output of the Message Eviction playbook to provide a table to the 
+    # user showing the deleted messages.
+    ################################################################################
+
+    template = """SOAR deleted messages in O365. The table below shows a summary of the messages.\n\n| Mailbox | Message ID | Status | Message |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "playbook_ms_graph_for_office_365_message_eviction_1:playbook_output:observable.mailbox",
+        "playbook_ms_graph_for_office_365_message_eviction_1:playbook_output:observable.value",
+        "playbook_ms_graph_for_office_365_message_eviction_1:playbook_output:observable.status",
+        "playbook_ms_graph_for_office_365_message_eviction_1:playbook_output:observable.message"
+    ]
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_note")
+
+    update_workbook_task(container=container)
+
+    return
+
+
+@phantom.playbook_block()
+def update_workbook_task(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("update_workbook_task() called")
+
+    ################################################################################
+    # Upon completion, update the workbook task with the formatted output and mark 
+    # task as complete.
+    ################################################################################
+
+    id_value = container.get("id", None)
+    format_note = phantom.get_format_data(name="format_note")
+
+    parameters = []
+
+    parameters.append({
+        "owner": None,
+        "status": "complete",
+        "container": id_value,
+        "task_name": "playbook",
+        "note_title": "Search and Purge Results",
+        "note_content": format_note,
+    })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.custom_function(custom_function="community/workbook_task_update", parameters=parameters, name="update_workbook_task", callback=format_artifact)
+
+    return
+
+
+@phantom.playbook_block()
+def format_artifact(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("format_artifact() called")
+
+    ################################################################################
+    # These artifacts capture the message ID and the mailbox they were removed from 
+    # so that they can be restored later.
+    ################################################################################
+
+    template = """%%\n{{\"cef_data\": \n{{\"email\": \"{0}\", \"internet message id\": \"{1}\"}}}}\n%%"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "playbook_ms_graph_for_office_365_message_eviction_1:playbook_input:email",
+        "playbook_ms_graph_for_office_365_message_eviction_1:playbook_input:message_id"
+    ]
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_artifact")
+
+    create_artifacts_0(container=container)
+
+    return
+
+
+@phantom.playbook_block()
+def create_artifacts_0(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("create_artifacts_0() called")
+
+    ################################################################################
+    # These artifacts capture the message ID and the mailbox they were removed from 
+    # so that they can be restored later.
+    ################################################################################
+
+    id_value = container.get("id", None)
+    format_artifact__as_list = phantom.get_format_data(name="format_artifact__as_list")
+
+    parameters = []
+
+    # build parameters list for 'create_artifacts_0' call
+    for format_artifact__item in format_artifact__as_list:
+        parameters.append({
+            "name": "Purged Email Results",
+            "tags": None,
+            "label": "office_365_delete",
+            "severity": None,
+            "cef_field": None,
+            "cef_value": None,
+            "container": id_value,
+            "input_json": format_artifact__item,
+            "cef_data_type": None,
+            "run_automation": None,
+        })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.custom_function(custom_function="community/artifact_create", parameters=parameters, name="create_artifacts_0")
+
+    return
+
+
+@phantom.playbook_block()
+def input_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_decision() called")
+
+    # check for 'if' condition 1
+    found_match_1 = phantom.decision(
+        container=container,
+        conditions=[
+            ["artifact:*.cef.internet message id", "!=", ""]
+        ],
+        delimiter=None)
+
+    # call connected blocks if condition 1 matched
+    if found_match_1:
+        input_filter(action=action, success=success, container=container, results=results, handle=handle)
+        return
+
+    # check for 'else' condition 2
+    artifact_does_not_exist(action=action, success=success, container=container, results=results, handle=handle)
+
+    return
+
+
+@phantom.playbook_block()
+def input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_filter() called")
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["artifact:*.cef.internet message id", "!=", ""]
+        ],
+        name="input_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("format_prompt() called")
+
+    template = """| Mailbox | Subject | Email ID |\n| --- | --- | --- |\n%%\n| {0} | {1} | {2} |\n%%\n"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:identifier_filter:condition_2:playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1:playbook_output:observables.recipient",
+        "filtered-data:identifier_filter:condition_2:playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1:playbook_output:observables.subject",
+        "filtered-data:identifier_filter:condition_2:playbook_ms_graph_for_office_365_message_identifier_activity_analysis_1:playbook_output:observables.value"
+    ]
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_prompt")
+
+    delete_email_prompt_1(container=container)
+
+    return
+
+
+@phantom.playbook_block()
+def delete_email_prompt_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("delete_email_prompt_1() called")
+
+    # set user and message variables for phantom.prompt call
+
+    user = container.get('owner_name', None)
+    role = None
+    message = """The following emails will be deleted. These emails will be recoverable but will not be visible in the mailbox.\n\n{0} """
+
+    # parameter list for template variable replacement
+    parameters = [
+        "format_prompt:formatted_data"
+    ]
+
+    # responses
+    response_types = [
+        {
+            "prompt": "Delete these messages?",
+            "options": {
+                "type": "list",
+                "choices": [
+                    "Yes",
+                    "No"
+                ],
+            },
+        }
+    ]
+
+    phantom.prompt2(container=container, user=user, role=role, message=message, respond_in_mins=30, name="delete_email_prompt_1", parameters=parameters, response_types=response_types, callback=prompt_decision)
+
+    return
+
+
+@phantom.playbook_block()
+def prompt_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("prompt_decision() called")
+
+    # check for 'if' condition 1
+    found_match_1 = phantom.decision(
+        container=container,
+        conditions=[
+            ["delete_email_prompt_1:action_result.summary.responses.0", "==", "yes"]
+        ],
+        delimiter=None)
+
+    # call connected blocks if condition 1 matched
+    if found_match_1:
+        playbook_ms_graph_for_office_365_message_eviction_1(action=action, success=success, container=container, results=results, handle=handle)
+        return
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    return

playbooks/MS_Graph_for_Office_365_Search_and_Purge.yml

@@ -0,0 +1,28 @@
+name: MS Graph for Office365 Search and Purge
+id: 5112d6ad-a8c4-47ed-b831-928ac1dff716
+version: 1
+date: '2024-02-03'
+author: Lou Stella, Splunk
+type: Response
+description: Accepts an Internet Message ID, searches for its presence in each mailbox in the tenant, and then deletes the ones it finds. Microsoft does have a "soft-delete" option, messages run through the Message Eviction playbook will be recoverable.
+playbook: MS_Graph_for_Office_365_Search_and_Purge
+how_to_implement: This input playbook requires the MS Graph for Office365 connector to be configured.  Careful attention should be paid to the documentation for this connector's required permissions.
+references: []
+app_list: 
+  - MS Graph for Office 365
+tags:
+  platform_tags:
+    - message_eviction
+    - message_identifier_activity
+    - internet_message_id
+    - ms_graph_for_office_365
+  playbook_type: Automation
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: 
+    - D3-ER
+    - D3-IAA

playbooks/MS_Graph_for_Office_365_Search_and_Restore.json

@@ -0,0 +1,648 @@
+{
+  "blockly": false,
+  "blockly_xml": "<xml></xml>",
+  "category": "Search and Restore",
+  "coa": {
+    "data": {
+      "description": "Accepts an Internet Message ID and an email mailbox, searches for the Message ID's presence in each mailbox's recoverable deleted items, and then restores the ones it finds. ",
+      "edges": [
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_2_to_port_3",
+          "sourceNode": "2",
+          "sourcePort": "2_out",
+          "targetNode": "3",
+          "targetPort": "3_in"
+        },
+        {
+          "id": "port_3_to_port_5",
+          "sourceNode": "3",
+          "sourcePort": "3_out",
+          "targetNode": "5",
+          "targetPort": "5_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_5_to_port_6",
+          "sourceNode": "5",
+          "sourcePort": "5_out",
+          "targetNode": "6",
+          "targetPort": "6_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 1
+            }
+          ],
+          "id": "port_5_to_port_7",
+          "sourceNode": "5",
+          "sourcePort": "5_out",
+          "targetNode": "7",
+          "targetPort": "7_in"
+        },
+        {
+          "id": "port_6_to_port_8",
+          "sourceNode": "6",
+          "sourcePort": "6_out",
+          "targetNode": "8",
+          "targetPort": "8_in"
+        },
+        {
+          "id": "port_8_to_port_1",
+          "sourceNode": "8",
+          "sourcePort": "8_out",
+          "targetNode": "1",
+          "targetPort": "1_in"
+        },
+        {
+          "id": "port_0_to_port_9",
+          "sourceNode": "0",
+          "sourcePort": "0_out",
+          "targetNode": "9",
+          "targetPort": "9_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 0
+            }
+          ],
+          "id": "port_9_to_port_2",
+          "sourceNode": "9",
+          "sourcePort": "9_out",
+          "targetNode": "2",
+          "targetPort": "2_in"
+        },
+        {
+          "conditions": [
+            {
+              "index": 1
+            }
+          ],
+          "id": "port_9_to_port_4",
+          "sourceNode": "9",
+          "sourcePort": "9_out",
+          "targetNode": "4",
+          "targetPort": "4_in"
+        }
+      ],
+      "hash": "4ee1977833d0fcb86a2fe51865bafe8d05cf652f",
+      "nodes": {
+        "0": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_start",
+            "id": "0",
+            "type": "start"
+          },
+          "errors": {},
+          "id": "0",
+          "type": "start",
+          "warnings": {},
+          "x": 330,
+          "y": 0
+        },
+        "1": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionName": "on_finish",
+            "id": "1",
+            "type": "end"
+          },
+          "errors": {},
+          "id": "1",
+          "type": "end",
+          "warnings": {},
+          "x": 20,
+          "y": 1208
+        },
+        "2": {
+          "data": {
+            "advanced": {
+              "customName": "input filter",
+              "customNameId": 0,
+              "description": "ensures the artifact this is running against has the right fields",
+              "join": [],
+              "note": "ensures the artifact this is running against has the right fields"
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "artifact:*.cef.internet message id",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "internet message id exists",
+                "logic": "and"
+              }
+            ],
+            "functionId": 1,
+            "functionName": "input_filter",
+            "id": "2",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "2",
+          "type": "filter",
+          "warnings": {},
+          "x": 230,
+          "y": 328
+        },
+        "3": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "functionId": 1,
+            "functionName": "playbook_MS_Graph_for_Office_365_Message_Restore_1",
+            "id": "3",
+            "inputs": {
+              "email": {
+                "datapaths": [
+                  "filtered-data:input_filter:condition_1:artifact:*.cef.email"
+                ],
+                "deduplicate": false
+              },
+              "message_id": {
+                "datapaths": [
+                  "filtered-data:input_filter:condition_1:artifact:*.cef.internet message id"
+                ],
+                "deduplicate": false
+              }
+            },
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "playbookName": "MS_Graph_for_Office_365_Message_Restore",
+            "playbookRepo": 2,
+            "playbookRepoName": "local",
+            "playbookType": "data",
+            "synchronous": true,
+            "type": "playbook"
+          },
+          "errors": {},
+          "id": "3",
+          "type": "playbook",
+          "warnings": {
+            "config": [
+              "Reconfigure invalid datapath."
+            ]
+          },
+          "x": 170,
+          "y": 508
+        },
+        "4": {
+          "data": {
+            "advanced": {
+              "customName": "artifact does not exist",
+              "customNameId": 0,
+              "description": "In the event an artifact does not exist suitable for this usecase, inform the user.",
+              "join": [],
+              "note": "In the event an artifact does not exist suitable for this usecase, inform the user."
+            },
+            "functionId": 1,
+            "functionName": "artifact_does_not_exist",
+            "id": "4",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "selectMore": false,
+            "tab": "apis",
+            "type": "utility",
+            "utilities": {
+              "comment": {
+                "description": "",
+                "fields": [
+                  {
+                    "description": "",
+                    "label": "comment",
+                    "name": "comment",
+                    "placeholder": "Enter a comment",
+                    "renderType": "datapath",
+                    "required": true
+                  },
+                  {
+                    "hidden": true,
+                    "name": "container",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "author",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "trace",
+                    "required": false
+                  }
+                ],
+                "label": "add comment",
+                "name": "comment"
+              }
+            },
+            "utilityType": "api",
+            "values": {
+              "comment": {
+                "_internal": [
+                  "container",
+                  "author",
+                  "trace"
+                ],
+                "comment": "\"No Internet Message ID artifacts found\""
+              }
+            }
+          },
+          "errors": {},
+          "id": "4",
+          "type": "utility",
+          "warnings": {},
+          "x": 450,
+          "y": 329
+        },
+        "5": {
+          "data": {
+            "advanced": {
+              "join": []
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables",
+                    "value": "None"
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "observable exists",
+                "logic": "and"
+              },
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 1,
+                    "op": "==",
+                    "param": "playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables",
+                    "value": "None"
+                  }
+                ],
+                "conditionIndex": 1,
+                "customName": "observable does not exist",
+                "logic": "and"
+              }
+            ],
+            "functionId": 2,
+            "functionName": "filter_2",
+            "id": "5",
+            "type": "filter"
+          },
+          "errors": {},
+          "id": "5",
+          "type": "filter",
+          "warnings": {},
+          "x": 230,
+          "y": 672
+        },
+        "6": {
+          "data": {
+            "advanced": {
+              "customName": "format note",
+              "customNameId": 0,
+              "description": "Format the output of the Message Restore playbook to provide a table to the user showing the deleted messages.",
+              "join": [],
+              "note": "Format the output of the Message Restore playbook to provide a table to the user showing the deleted messages."
+            },
+            "functionId": 1,
+            "functionName": "format_note",
+            "id": "6",
+            "parameters": [
+              "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.mailbox",
+              "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.value",
+              "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.status",
+              "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.message"
+            ],
+            "template": "SOAR restored messages in O365. The table below shows a summary of the messages.\n\n| Mailbox | Message ID | Status | Message |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%",
+            "type": "format"
+          },
+          "errors": {},
+          "id": "6",
+          "type": "format",
+          "warnings": {},
+          "x": 0,
+          "y": 852
+        },
+        "7": {
+          "data": {
+            "advanced": {
+              "customName": "No Observable Found",
+              "customNameId": 0,
+              "description": "In the event the Message Restore playbook does not return an observable, inform the user.",
+              "join": [],
+              "note": "In the event the Message Restore playbook does not return an observable, inform the user."
+            },
+            "functionId": 2,
+            "functionName": "no_observable_found",
+            "id": "7",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "selectMore": false,
+            "tab": "apis",
+            "type": "utility",
+            "utilities": {
+              "comment": {
+                "description": "",
+                "fields": [
+                  {
+                    "description": "",
+                    "label": "comment",
+                    "name": "comment",
+                    "placeholder": "Enter a comment",
+                    "renderType": "datapath",
+                    "required": true
+                  },
+                  {
+                    "hidden": true,
+                    "name": "container",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "author",
+                    "required": false
+                  },
+                  {
+                    "hidden": true,
+                    "name": "trace",
+                    "required": false
+                  }
+                ],
+                "label": "add comment",
+                "name": "comment"
+              }
+            },
+            "utilityType": "api",
+            "values": {
+              "comment": {
+                "_internal": [
+                  "container",
+                  "author",
+                  "trace"
+                ],
+                "comment": "No observable output found for dispatched playbook."
+              }
+            }
+          },
+          "errors": {},
+          "id": "7",
+          "type": "utility",
+          "warnings": {},
+          "x": 340,
+          "y": 852
+        },
+        "8": {
+          "data": {
+            "advanced": {
+              "customName": "Update Workbook Task",
+              "customNameId": 0,
+              "description": "Upon completion, update the workbook task with the formatted output and mark task as complete.",
+              "join": [],
+              "note": "Upon completion, update the workbook task with the formatted output and mark task as complete."
+            },
+            "customFunction": {
+              "draftMode": false,
+              "name": "workbook_task_update",
+              "repoName": "community"
+            },
+            "functionId": 3,
+            "functionName": "update_workbook_task",
+            "id": "8",
+            "loop": {
+              "enabled": false,
+              "exitAfterUnit": "m",
+              "exitAfterValue": 10,
+              "exitConditionEnabled": false,
+              "exitLoopAfter": 2,
+              "pauseUnit": "m",
+              "pauseValue": 2
+            },
+            "selectMore": false,
+            "type": "utility",
+            "utilities": {
+              "workbook_task_update": {
+                "description": "Update a workbook task by task name or the task where the currently running playbook appears. Requires a task_name, container_id, and a note_title, note_content, owner, or status.",
+                "fields": [
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Name of a workbook task or keyword 'playbook' to update the task where the currently running playbook appears. (Required)",
+                    "inputType": "item",
+                    "label": "task_name",
+                    "name": "task_name",
+                    "placeholder": "my_task",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Note title. (Optional)",
+                    "inputType": "item",
+                    "label": "note_title",
+                    "name": "note_title",
+                    "placeholder": "My Title",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Note content. (Optional)",
+                    "inputType": "item",
+                    "label": "note_content",
+                    "name": "note_content",
+                    "placeholder": "My notes",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "Accepts 'incomplete', 'in_progress, or 'complete'. (Optional)",
+                    "inputType": "item",
+                    "label": "status",
+                    "name": "status",
+                    "placeholder": "in_progress",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "*"
+                    ],
+                    "description": "A user to assign as the task owner or keyword 'current\" to assign the task to the user that launched the playbook. (Optional)",
+                    "inputType": "item",
+                    "label": "owner",
+                    "name": "owner",
+                    "placeholder": "username",
+                    "renderType": "datapath",
+                    "required": false
+                  },
+                  {
+                    "dataTypes": [
+                      "phantom container id"
+                    ],
+                    "description": "The ID of a SOAR Container. (Required)",
+                    "inputType": "item",
+                    "label": "container",
+                    "name": "container",
+                    "placeholder": "container:id",
+                    "renderType": "datapath",
+                    "required": false
+                  }
+                ],
+                "label": "workbook_task_update",
+                "name": "workbook_task_update"
+              }
+            },
+            "utilityType": "custom_function",
+            "values": {
+              "workbook_task_update": {
+                "container": "container:id",
+                "note_content": "format_note:formatted_data",
+                "note_title": "Search and Restore Results",
+                "owner": null,
+                "status": "complete",
+                "task_name": "playbook"
+              }
+            }
+          },
+          "errors": {},
+          "id": "8",
+          "type": "utility",
+          "warnings": {},
+          "x": 0,
+          "y": 1030
+        },
+        "9": {
+          "data": {
+            "advanced": {
+              "customName": "input decision",
+              "customNameId": 0,
+              "description": "ensures the artifact this is running against has the right fields",
+              "join": [],
+              "note": "ensures the artifact this is running against has the right fields"
+            },
+            "conditions": [
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "artifact:*.cef.internet message id",
+                    "value": ""
+                  },
+                  {
+                    "conditionIndex": 0,
+                    "op": "!=",
+                    "param": "artifact:*.cef.email",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 0,
+                "customName": "artifact exists",
+                "display": "If",
+                "logic": "and",
+                "type": "if"
+              },
+              {
+                "comparisons": [
+                  {
+                    "conditionIndex": 1,
+                    "op": "==",
+                    "param": "",
+                    "value": ""
+                  }
+                ],
+                "conditionIndex": 1,
+                "customName": "artifact does not exist",
+                "display": "Else",
+                "logic": "and",
+                "type": "else"
+              }
+            ],
+            "functionId": 1,
+            "functionName": "input_decision",
+            "id": "9",
+            "type": "decision"
+          },
+          "errors": {},
+          "id": "9",
+          "type": "decision",
+          "warnings": {},
+          "x": 390,
+          "y": 148
+        }
+      },
+      "notes": "Inputs: internet message ID\nActions: Message Restore\nOutputs: report, workbook update task"
+    },
+    "input_spec": null,
+    "output_spec": null,
+    "playbook_type": "automation",
+    "python_version": "3",
+    "schema": "5.0.11",
+    "version": "6.2.0.355"
+  },
+  "create_time": "2024-02-28T18:48:45.977494+00:00",
+  "draft_mode": false,
+  "labels": [
+    "*"
+  ],
+  "tags": [
+    "message_restore",
+    "ms_graph_for_o365",
+    "internet_message_id",
+    "D3-RE"
+  ]
+}

playbooks/MS_Graph_for_Office_365_Search_and_Restore.py

@@ -0,0 +1,272 @@
+"""
+Accepts an Internet Message ID and an email mailbox, searches for the Message ID's presence in each mailbox's recoverable deleted items, and then restores the ones it finds. 
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'input_decision' block
+    input_decision(container=container)
+
+    return
+
+@phantom.playbook_block()
+def input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_filter() called")
+
+    ################################################################################
+    # ensures the artifact this is running against has the right fields
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["artifact:*.cef.internet message id", "!=", ""]
+        ],
+        name="input_filter:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        playbook_ms_graph_for_office_365_message_restore_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def playbook_ms_graph_for_office_365_message_restore_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("playbook_ms_graph_for_office_365_message_restore_1() called")
+
+    filtered_artifact_0_data_input_filter = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_1:artifact:*.cef.internet message id","filtered-data:input_filter:condition_1:artifact:*.cef.email"])
+
+    filtered_artifact_0__cef_internet_message_id = [item[0] for item in filtered_artifact_0_data_input_filter]
+    filtered_artifact_0__cef_email = [item[1] for item in filtered_artifact_0_data_input_filter]
+
+    inputs = {
+        "message_id": filtered_artifact_0__cef_internet_message_id,
+        "email": filtered_artifact_0__cef_email,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    # call playbook "local/MS_Graph_for_Office_365_Message_Restore", returns the playbook_run_id
+    playbook_run_id = phantom.playbook("local/MS_Graph_for_Office_365_Message_Restore", container=container, name="playbook_ms_graph_for_office_365_message_restore_1", callback=filter_2, inputs=inputs)
+
+    return
+
+
+@phantom.playbook_block()
+def artifact_does_not_exist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("artifact_does_not_exist() called")
+
+    ################################################################################
+    # In the event an artifact does not exist suitable for this usecase, inform the 
+    # user.
+    ################################################################################
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.comment(container=container, comment="\"No Internet Message ID artifacts found\"")
+
+    return
+
+
+@phantom.playbook_block()
+def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("filter_2() called")
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables", "!=", None]
+        ],
+        name="filter_2:condition_1",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        format_note(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    # collect filtered artifact ids and results for 'if' condition 2
+    matched_artifacts_2, matched_results_2 = phantom.condition(
+        container=container,
+        conditions=[
+            ["playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables", "==", None]
+        ],
+        name="filter_2:condition_2",
+        delimiter=None)
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_2 or matched_results_2:
+        no_observable_found(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)
+
+    return
+
+
+@phantom.playbook_block()
+def format_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("format_note() called")
+
+    ################################################################################
+    # Format the output of the Message Restore playbook to provide a table to the 
+    # user showing the deleted messages.
+    ################################################################################
+
+    template = """SOAR restored messages in O365. The table below shows a summary of the messages.\n\n| Mailbox | Message ID | Status | Message |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.mailbox",
+        "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.value",
+        "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.status",
+        "filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.message"
+    ]
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_note")
+
+    update_workbook_task(container=container)
+
+    return
+
+
+@phantom.playbook_block()
+def no_observable_found(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("no_observable_found() called")
+
+    ################################################################################
+    # In the event the Message Restore playbook does not return an observable, inform 
+    # the user.
+    ################################################################################
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.comment(container=container, comment="No observable output found for dispatched playbook.")
+
+    return
+
+
+@phantom.playbook_block()
+def update_workbook_task(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("update_workbook_task() called")
+
+    ################################################################################
+    # Upon completion, update the workbook task with the formatted output and mark 
+    # task as complete.
+    ################################################################################
+
+    id_value = container.get("id", None)
+    format_note = phantom.get_format_data(name="format_note")
+
+    parameters = []
+
+    parameters.append({
+        "owner": None,
+        "status": "complete",
+        "container": id_value,
+        "task_name": "playbook",
+        "note_title": "Search and Restore Results",
+        "note_content": format_note,
+    })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.custom_function(custom_function="community/workbook_task_update", parameters=parameters, name="update_workbook_task")
+
+    return
+
+
+@phantom.playbook_block()
+def input_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
+    phantom.debug("input_decision() called")
+
+    ################################################################################
+    # ensures the artifact this is running against has the right fields
+    ################################################################################
+
+    # check for 'if' condition 1
+    found_match_1 = phantom.decision(
+        container=container,
+        logical_operator="and",
+        conditions=[
+            ["artifact:*.cef.internet message id", "!=", ""],
+            ["artifact:*.cef.email", "!=", ""]
+        ],
+        delimiter=None)
+
+    # call connected blocks if condition 1 matched
+    if found_match_1:
+        input_filter(action=action, success=success, container=container, results=results, handle=handle)
+        return
+
+    # check for 'else' condition 2
+    artifact_does_not_exist(action=action, success=success, container=container, results=results, handle=handle)
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    return

playbooks/MS_Graph_for_Office_365_Search_and_Restore.yml

@@ -0,0 +1,27 @@
+name: MS Graph for Office365 Search and Restore
+id: 511236ad-a8c4-47ed-b631-928ab1dff71a
+version: 1
+date: '2024-02-15'
+author: Lou Stella, Splunk
+type: Response
+description: Accepts an Internet Message ID and an email mailbox, searches for the Message ID's presence in each mailbox's recoverable deleted items, and then restores the ones it finds. 
+playbook: MS_Graph_for_Office_365_Search_and_Restore
+how_to_implement: This input playbook requires the MS Graph for Office365 connector to be configured.  Careful attention should be paid to the documentation for this connector's required permissions.
+references: []
+app_list: 
+  - MS Graph for Office 365
+tags:
+  platform_tags:
+    - message_restore
+    - message_identifier_activity
+    - internet_message_id
+    - ms_graph_for_office_365
+  playbook_type: Automation
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: 
+    - D3-RE

stories/jetbrains_teamcity_vulnerabilities.yml

@@ -0,0 +1,23 @@
+name: JetBrains TeamCity Vulnerabilities
+id: 3cd841e8-2f64-45e8-b148-7767255db111
+version: 1
+date: '2024-03-04'
+author: Michael Haag, Splunk
+description: This story provides a high-level overview of JetBrains TeamCity vulnerabilities and how to detect and respond to them using Splunk.
+narrative: JetBrains TeamCity is a continuous integration and deployment server that allows developers to automate the process of building, testing, and deploying code. It is a popular tool used by many organizations to streamline their development and deployment processes. However, like any software, JetBrains TeamCity is not immune to vulnerabilities.
+references:
+- https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
+- https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
+- https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
+tags:
+  analytic_story: JetBrains TeamCity Vulnerabilities
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
+  cve:
+  - CVE-2024-27198
+  - CVE-2024-27199