Branch was auto-updated.

detections/endpoint/adsisearcher_account_discovery.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate

detections/endpoint/domain_group_discovery_with_adsisearcher.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate

detections/endpoint/elevated_group_discovery_with_powerview.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember`
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -4,8 +4,7 @@ version: 2
 date: '2021-11-18'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic identifies executable files (.exe or .dll) being
   written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
   suspicious behavior as its commonly used by tools like like PsExec/PaExec and others

detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet
   used to obtain the password policy in a Windows domain. Red Teams and adversaries

detections/endpoint/get_aduser_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet
   is used to return a list of all domain users. Red Teams and adversaries may leverage

detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-26'
 author: Teoderick Contreras, MAuricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet
   used to obtain the password policy in a Windows domain. Red Teams and adversaries

detections/endpoint/get_domainpolicy_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-26'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get DomainPolicy` commandlet used to obtain the
   password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell

detections/endpoint/get_domainuser_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is
   part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.

detections/endpoint/get_foresttrust_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-02'
 author: Michael Haag, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output

detections/endpoint/getadcomputer_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-01'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet
   is used to return a list of all domain computers. Red Teams and adversaries may

detections/endpoint/getadgroup_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet
   is used to return a list of all domain groups. Red Teams and adversaries may leverage

detections/endpoint/getcurrent_user_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET
   class. This method returns an object that represents the current Windows user. Red

detections/endpoint/getdomaincomputer_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-02'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer`
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.

detections/endpoint/getdomaincontroller_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-02'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController`
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.

detections/endpoint/getdomaingroup_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-26'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup`
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.

detections/endpoint/getlocaluser_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser`
   commandlet is used to return a list of all local users. Red Teams and adversaries

detections/endpoint/getnettcpconnection_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-10'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet
   is used to return a listing of network connections on a compromised system. Red

detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-01'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class
   parameter leverages WMI to query for all domain computers. Red Teams and adversaries

detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-WmiObject` commandlet used with specific parameters
   . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams

detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class
   parameter leverages WMI to query for all domain users. Red Teams and adversaries

detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Get-WmiObject` commandlet used with specific parameters.
   The `Win32_UserAccount` parameter is used to return a list of all local users. Red

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-18'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the usage of the `Enter-PSSession`. This commandlet can be used to open
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-14'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies one source endpoint failing to authenticate
   with multiple disabled domain users using the Kerberos protocol. This behavior could
   represent an adversary performing a Password Spraying attack against an Active Directory

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-14'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies one source endpoint failing to authenticate
   with multiple invalid domain users using the Kerberos protocol. This behavior could
   represent an adversary performing a Password Spraying attack against an Active Directory

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-15'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies one source endpoint failing to authenticate
   with multiple invalid users using the NTLM protocol. This behavior could represent
   an adversary performing a Password Spraying attack against an Active Directory environment

detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-13'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies a source user failing to authenticate
   with multiple users using explicit credentials on a host. This behavior could represent
   an adversary performing a Password Spraying attack against an Active Directory environment

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-08'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies one source endpoint failing to authenticate
   with multiple valid users using the Kerberos protocol. This behavior could represent
   an adversary performing a Password Spraying attack against an Active Directory environment

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-13'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies one source endpoint failing to authenticate
   with multiple valid users using the NTLM protocol. This behavior could represent
   an adversary performing a Password Spraying attack against an Active Directory environment

detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-13'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies a source process name failing to authenticate
   with multiple users. This behavior could represent an adversary performing a Password
   Spraying attack against an Active Directory environment to obtain initial access

detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-04-13'
 author: Mauricio Velazco, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies a source host failing to authenticate
   against a remote host with multiple users. This behavior could represent an adversary
   performing a Password Spraying attack against an Active Directory environment to

detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-14'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-15'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of PowerShell with arguments utilized to start a process
   on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-16'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of PowerShell with arguments utilized to start a process
   on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-15'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
   to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries

detections/endpoint/remote_system_discovery_with_adsisearcher.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-01'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to

detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-10-14'
 author: Michael Haag, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic identifies `powershell.exe` usage, using Script
   Block Logging EventCode 4104, related to querying the domain for Service Principle
   Names. typically, this is a precursor activity related to kerberoasting or the silver

detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the use of PowerShell environment variables to identify the current
   logged user. Red Teams and adversaries may leverage this method to identify the

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -4,8 +4,7 @@ version: 2
 date: '2021-11-22'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
   to identify the creation of a Windows Service where the service binary path path
   is located in a non-common Service folder in Windows. Red Teams and adversaries

detections/endpoint/windows_service_created_within_public_path.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-22'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
   to identify the creation of a Windows Service where the service binary path is located
   in public paths. This behavior could represent the installation of a malicious service.

detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-29'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following hunting analytic leverages Event ID 4698, `A scheduled
   task was created`, to identify the creation of a Scheduled Task with a suspicious,
   high entropy, Task Name. To achieve this, this analytic also leverages the `ut_shannon`

detections/experimental/endpoint/randomly_generated_windows_service_name.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-29'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following hunting analytic leverages Event ID 7045, `A new service
   was installed in the system`, to identify the installation of a Windows Service
   with a suspicious, high entropy, Service Name. To achieve this, this analytic also

detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-12-01'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following hunting analytic leverages Event ID 4769, `A Kerberos
   service ticket was requested`, to identify an unusual number of computer service
   ticket requests from one source. When a domain joined endpoint connects to a remote

detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-12-01'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following hunting analytic leverages Event ID 4624, `An account
   was successfully logged on`, to identify an unusual number of remote authentication
   attempts coming from one source. An endpoint authenticating to a large number of