From 0cee900ae32cc9a294ffa2308f8becac35f0dcd4 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 3 Nov 2020 16:29:27 +0000 Subject: [PATCH] Added detection testing service results inAttempt To Add Certificate To Untrusted Store --- .../attempt_to_add_certificate_to_untrusted_store.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index fa9f5f98b2..d44f73ed69 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -13,9 +13,9 @@ references: [] author: Patrick Bareiss, Rico Valdez, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* - (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user - | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` - | `attempt_to_add_certificate_to_untrusted_store_filter`' + (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name + Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`' known_false_positives: There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems. @@ -37,3 +37,6 @@ tags: - PR.IP security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1553.004/windows-sysmon.log