From 0d21523ff1c1693bb01f047e24e371be169da77d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 25 Aug 2021 11:38:28 -0400 Subject: [PATCH] correcting analytic type --- detections/endpoint/getlocaluser_with_powershell.yml | 2 +- .../endpoint/getlocaluser_with_powershell_script_block.yml | 2 +- .../endpoint/getwmiobject_user_account_with_powershell.yml | 4 ++-- ...getwmiobject_user_account_with_powershell_script_block.yml | 2 +- detections/endpoint/local_account_discovery_with_net.yml | 2 +- detections/endpoint/local_account_discovery_with_wmic.yml | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index dbf3042702..f7ae34c792 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -3,7 +3,7 @@ id: 85fae8fa-0427-11ec-8b78-acde48001122 version: 1 date: '2021-08-23' author: Mauricio Velazco, Splunk -type: hunt +type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `powershell.exe` with command-line diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml index 009100f1c8..d9089f5c7c 100644 --- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml +++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml @@ -3,7 +3,7 @@ id: 2e891cbe-0426-11ec-9c9c-acde48001122 version: 1 date: '2021-08-23' author: Mauricio Velazco, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 59c1ed6c72..9be91277a6 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -3,14 +3,14 @@ id: b44f6ac6-0429-11ec-87e9-acde48001122 version: 1 date: '2021-08-23' author: Mauricio Velazco, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* OR Processes.process=*Win32_UserAccount*) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`' diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index c218e3be83..b6fb731671 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -3,7 +3,7 @@ id: 640b0eda-0429-11ec-accd-acde48001122 version: 1 date: '2021-08-23' author: Mauricio Velazco, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index e543af403f..505ad8b723 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 5d0d4830-0133-11ec-bae3-acde48001122 version: 1 date: '2021-08-19' author: Mauricio Velazco, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index c1fe24cbe7..58ad212ff3 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -3,7 +3,7 @@ id: 4902d7aa-0134-11ec-9d65-acde48001122 version: 1 date: '2021-08-19' author: Mauricio Velazco, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `wmic.exe` with command-line