Merge pull request #2817 from splunk/observables_set_4

Observables Set 4

detections/endpoint/suspicious_copy_on_system32.yml

@@ -44,7 +44,7 @@ tags:
   asset_type: Endpoint
   confidence: 90
   impact: 70
-  message: execution of copy exe to copy file from $process$ in $dest$
+  message: Execution of copy exe to copy file from $process$ in $dest$
   mitre_attack_id:
   - T1036.003
   - T1036
@@ -53,7 +53,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml

@@ -15,7 +15,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_dllhost` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -45,7 +45,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_event_log_service_behavior.yml

@@ -15,8 +15,7 @@ description: The following analytic utilizes Windows Event ID 1100 to identify w
 data_source:
 - Sysmon Event ID 1
 search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter`
+  max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 known_false_positives: It is possible the Event Logging service gets shut down due
@@ -34,12 +33,12 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: The Windows Event Log Service shutdown on $ComputerName$
+  message: The Windows Event Log Service shutdown on $dest$
   mitre_attack_id:
   - T1070
   - T1070.001
   observable:
-  - name: ComputerName
+  - name: dest
     type: Endpoint
     role:
     - Victim

detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml

@@ -15,7 +15,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_gpupdate` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -44,7 +44,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_image_creation_in_appdata_folder.yml

@@ -38,11 +38,11 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: process $process_name$ creating image file $file_path$ in $dest$
+  message: Process $process_name$ creating image file $file_path$ in $dest$
   mitre_attack_id:
   - T1113
   observable:
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim

detections/endpoint/suspicious_kerberos_service_ticket_request.yml

@@ -17,8 +17,8 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
 data_source:
 - Windows Security 4769
 search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name)
-  = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 |
-  table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
+  = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 | rename ComputerName as dest| rename Account_Name as user  |
+  table _time, dest, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
   | `suspicious_kerberos_service_ticket_request_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
@@ -42,12 +42,12 @@ tags:
   - CVE-2021-42287
   - CVE-2021-42278
   impact: 100
-  message: A suspicious Kerberos Service Ticket was requested by $Account_Name$
+  message: A suspicious Kerberos Service Ticket was requested by $user$ on host $dest$
   mitre_attack_id:
   - T1078
   - T1078.002
   observable:
-  - name: ComputerName
+  - name: dest
     type: Endpoint
     role:
     - Victim

detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml

@@ -41,7 +41,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_msbuild_path.yml

@@ -52,7 +52,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_msbuild_spawn.yml

@@ -46,7 +46,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -13,7 +13,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*"))
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,

detections/endpoint/suspicious_rundll32_dllregisterserver.yml

@@ -16,7 +16,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver*
-  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_dllregisterserver_filter`'

detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml

@@ -15,7 +15,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_rundll32` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -52,7 +52,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_rundll32_startw.yml

@@ -45,7 +45,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 70
-  message: rundll32.exe running with suspicious parameters on $dest$
+  message: rundll32.exe running with suspicious StartW parameters on $dest$
   mitre_attack_id:
   - T1218
   - T1218.011
@@ -54,7 +54,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_scheduled_task_from_public_directory.yml

@@ -35,7 +35,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 70
-  message: Suspicious scheduled task registered on $dest$
+  message: Suspicious scheduled task registered on $dest$ from Public Directory
   mitre_attack_id:
   - T1053.005
   - T1053
@@ -44,7 +44,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml

@@ -16,7 +16,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.process_name Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -45,7 +45,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/suspicious_wav_file_in_appdata_folder.yml

@@ -42,7 +42,7 @@ tags:
   mitre_attack_id:
   - T1113
   observable:
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim

detections/endpoint/suspicious_wevtutil_usage.yml

@@ -43,7 +43,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Victim

detections/endpoint/system_information_discovery_detection.yml

@@ -29,7 +29,7 @@ tags:
   asset_type: Windows
   confidence: 50
   impact: 30
-  message: Potential system information discovery behavior on $dest$ by $User$
+  message: Potential system information discovery behavior on $dest$ by $user$
   mitre_attack_id:
   - T1082
   observable:
@@ -37,7 +37,7 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: User
+  - name: user
     type: User
     role:
     - Attacker

detections/endpoint/time_provider_persistence_registry.yml

@@ -14,7 +14,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*")
-  BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name
   Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -35,7 +35,7 @@ tags:
   asset_type: Endpoint
   confidence: 100
   impact: 80
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  message: modified/added/deleted registry entry $registry_path$ in $dest$
   mitre_attack_id:
   - T1547.003
   - T1547

detections/endpoint/uac_bypass_with_colorui_com_object.yml

@@ -10,10 +10,7 @@ description: This search is to detect a possible uac bypass using the colorui.dl
   where it make use of the colorui.dll COM CLSID to bypass UAC.
 data_source:
 - Sysmon Event ID 7
-search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe"
-  NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as
-  firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode
-  Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest parent_process_name process_name ImageLoaded signature_id signature Signed user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `uac_bypass_with_colorui_com_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -29,17 +26,13 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 60
-  message: The following module $ImageLoaded$ was loaded by a non-standard application
-    on endpoint $Computer$ by user $user$.
+  message: The following module $ImageLoaded$ was loaded by a non-standard application $parent_process_name$
+    on endpoint $dest$ by user $user_id$.
   mitre_attack_id:
   - T1218
   - T1218.003
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim

detections/endpoint/unknown_process_using_the_kerberos_protocol.yml

@@ -34,16 +34,12 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 60
-  message: ''
+  message: Unknown process $process_name$ using the kerberos protocol detected on host $dest$
   mitre_attack_id:
   - T1550
   observable:
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
-  - name: dest_ip
-    type: IP Address
+  - name: dest
+    type: Hostname
     role:
     - Victim
   product: