Branch was auto-updated.

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -19,7 +19,7 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -36,7 +36,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_renamed_psexec.yml

@@ -33,7 +33,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies executable files (.exe or .dll) being
   written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
-  suspicious behavior as its commonly user by tools like like PsExec/PaExec and others
+  suspicious behavior as its commonly used by tools like like PsExec/PaExec and others
   to stage service binaries before creating and starting a Windows service on remote
   endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
   movement and remote code execution. The Trickbot malware family also implements
@@ -31,7 +31,7 @@ references:
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - Trickbot
   automated_detection_testing: passed
   confidence: 100

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -36,7 +36,7 @@ references:
 - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/investigate_successful_remote_desktop_authentications.yml

@@ -23,7 +23,7 @@ references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - SamSam Ransomware
   product:
   - Splunk Phantom

detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml

@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/possible_lateral_movement_powershell_spawn.yml

@@ -0,0 +1,86 @@
+name: Possible Lateral Movement PowerShell Spawn
+id: cb909b3e-512b-11ec-aa31-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic assists with identifying a PowerShell process
+  spawned as a child or grand child process of commonly abused processes during lateral
+  movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe`
+  and `mmc.exe`. Legitimate Windows features such as the Service Control Manager,
+  Windows Management Instrumentation, Task Scheduler, Windows Remote Management and
+  the DCOM protocol can be abused to start a process on a remote endpoint. Looking
+  for PowerShell spawned out of this processes may reveal a lateral movement attack.
+  Red Teams and adversaries alike may abuse these services during a breach for lateral
+  movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe
+  OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe
+  OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe)
+  (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*)
+  OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may spawn PowerShell as a child process
+  of the the identified processes. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1021/003
+- https://attack.mitre.org/techniques/T1021/006/
+- https://attack.mitre.org/techniques/T1047/
+- https://attack.mitre.org/techniques/T1053.005/
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Malicious PowerShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  - Malicious PowerShell
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  - T1021.006
+  - T1047
+  - T1053.005
+  - T1543.003
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A PowerShell process was spawned as a child process of typically abused
+    processes on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml

@@ -27,7 +27,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml

@@ -25,7 +25,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml

@@ -28,7 +28,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml

@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml

@@ -27,7 +27,7 @@ references:
 - https://attack.mitre.org/techniques/T1021/006/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -30,7 +30,7 @@ tags:
   analytic_story:
   - Ransomware
   - Suspicious WMI Use
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml

@@ -27,7 +27,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml

@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml

@@ -29,7 +29,7 @@ references:
 - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1053/005/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -27,7 +27,7 @@ known_false_positives: Administrators may create scheduled tasks on remote syste
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed

detections/endpoint/services_exe_lolbas_execution_process_spawn.yml

@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `services.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Service Control
   Manager and creating a remote malicious service, the executed command is spawned
-  as a child processs of `services.exe`. The LOLBAS project documents Windows native
+  as a child process of `services.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of services.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/short_lived_scheduled_task.yml

@@ -0,0 +1,67 @@
+name: Short Lived Scheduled Task
+id: 6fa31414-546e-11ec-adfa-acde48001122
+version: 1
+date: '2021-12-03'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic leverages Windows Security EventCode 4698, `A
+  scheduled task was created` and Windows Security EventCode 4699, `A scheduled task
+  was deleted` to identify scheduled tasks created and deleted in less than 30 seconds.
+  This behavior may represent a lateral movement attack abusing the Task Scheduler
+  to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler
+  for lateral movement and remote code execution.
+search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message
+  | transaction Task_Name  startswith=(EventCode=4698) endswith=(EventCode=4699) |
+  eval short_lived=case((duration<30),"TRUE") | search  short_lived = TRUE | table
+  _time, ComputerName, Account_Name, Command, Task_Name, short_lived | `short_lived_scheduled_task_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: Although uncommon, legitimate applications may create and delete
+  a Scheduled Task within 30 seconds. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - ComputerName
+  - Account_Name
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  impact: 90
+  confidence: 90
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Lateral Movement
+  message: A windows scheduled task was created and deleted in 30 seconds on $ComputerName$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Command
+    type: Command
+    role:
+    - Target
+  automated_detection_testing: passed

detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml

@@ -49,7 +49,7 @@ references:
   - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml

@@ -51,7 +51,7 @@ references:
   - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml

@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Task Scheduler
   and creating a malicious remote scheduled task, the executed command is spawned
-  as a child processs of `svchost.exe`. The LOLBAS project documents Windows native
+  as a child process of `svchost.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of svchost.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -39,7 +39,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -28,7 +28,7 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/windows_service_created_within_public_path.yml

@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2020/07/21/lateral-movement-services/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/windows_service_creation_on_remote_endpoint.yml

@@ -28,7 +28,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/windows_service_initiation_on_remote_endpoint.yml

@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -47,7 +47,7 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - IcedID
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml

@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing Windows Management
-  Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`.
+  Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`.
   The LOLBAS project documents Windows native binaries that can be abused by threat
   actors to perform tasks like executing malicious code. Looking for child processes
   of wmiprvse.exe that are part of the LOLBAS project can help defenders identify
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml

@@ -40,7 +40,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml

@@ -0,0 +1,63 @@
+name: Randomly Generated Scheduled Task Name
+id: 9d22a780-5165-11ec-ad4f-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, 
+ to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this,
+ this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application.
+ Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task
+ and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec,
+ typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help
+ defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` 
+ should be customized by users. The Command field can be used to determine if the task has malicious intent or not. 
+search: ' `wineventlog_security` EventCode=4698 | xmlkv Message 
+| lookup ut_shannon_lookup word as Task_Name
+| where ut_shannon > 3
+| table  _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also
+  required.
+known_false_positives: Legitimate applications may use random Scheduled Task names.
+references:
+- https://attack.mitre.org/techniques/T1053/005/ 
+- https://splunkbase.splunk.com/app/2734/
+- https://en.wikipedia.org/wiki/Entropy_(information_theory) 
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  - Persistence
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Lateral Movement
+  message: 'A windows scheduled task with a suspicious task name was created on $dest$'
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  

detections/experimental/endpoint/randomly_generated_windows_service_name.yml

@@ -0,0 +1,65 @@
+name: Randomly Generated Windows Service Name
+id: 2032a95a-5165-11ec-a2c3-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, 
+ to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this,
+ this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application.
+ Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service
+ and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket,
+ typically create a Windows Service with a random service name on the victim host. This hunting analytic may help
+ defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` 
+ should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. 
+search: ' `wineventlog_system` EventCode=7045  
+| lookup ut_shannon_lookup word as Service_Name
+| where ut_shannon > 3
+| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints. The Windows TA as well as the URL ToolBox application are also
+  required.
+known_false_positives: Legitimate applications may use random Windows Service names.
+references:
+- https://attack.mitre.org/techniques/T1543/003/ 
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ComputerName
+  - Service_File_Name
+  - Service_Type
+  - Service_Name
+  - Service_Start_Type
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service with a suspicious service name was installed on $ComputerName$
+  observable:
+  - name: Service_File_Name
+    type: Other
+    role:
+    - Other
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim

detections/experimental/endpoint/remote_desktop_process_running_on_system.yml

@@ -28,7 +28,7 @@ references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml

@@ -0,0 +1,70 @@
+name: Unusual Number of Computer Service Tickets Requested
+id: ac3b81c0-52f4-11ec-ac44-acde48001122
+version: 1
+date: '2021-12-01'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, 
+ to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects 
+ to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint
+ requesting a large number of computer service tickets for different endpoints could represent malicious behavior like 
+ lateral movement, malware staging, reconnaissance, etc.\
+
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual number of service requests. To customize this
+ analytic, users can try different combinations of the `bucket` span time,  the
+ calculation of the `upperBound` field as well as the Outlier calculation. 
+ This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+search: ' `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
+| bucket span=2m _time 
+| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets by _time, Client_Address, Account_Name
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
+| `unusual_number_of_computer_service_tickets_requested_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: An single endpoint requesting a large number of computer service tickets 
+  is not common behavior. Possible false positive scenarios include but are not limited
+  to vulnerability scanners, administration systeams and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1078/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Reconnaissance
+  - Exploitation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - service
+  - service_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: 
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim
+  

detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml

@@ -0,0 +1,70 @@
+name: Unusual Number of Remote Endpoint Authentication Events
+id: acb5dc74-5324-11ec-a36d-acde48001122
+version: 1
+date: '2021-12-01'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, 
+ to identify an unusual number of remote authentication attempts coming from one source. An endpoint
+ authenticating to a large number of remote endpoints could represent malicious behavior like 
+ lateral movement, malware staging, reconnaissance, etc.\
+
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this
+ analytic, users can try different combinations of the `bucket` span time,  the
+ calculation of the `upperBound` field as well as the Outlier calculation. 
+ This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$"
+| eval Source_Account = mvindex(Account_Name, 1) 
+| bucket span=2m _time 
+| stats dc(ComputerName) AS unique_targets values(ComputerName) as target_hosts by _time, Source_Network_Address, Source_Account
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Source_Network_Address, Source_Account
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
+ `unusual_number_of_remote_endpoint_authentication_events_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers aas well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: An single endpoint authenticating to a large number of hosts 
+  is not common behavior. Possible false positive scenarios include but are not limited
+  to vulnerability scanners, jump servers and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1078/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Reconnaissance
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - Caller_Process_Name
+  - Security_ID
+  - Account_Name
+  - ComputerName
+  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  - Stage:Lateral Movement
+  message: 
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim

detections/experimental/network/remote_desktop_network_traffic.yml

@@ -32,7 +32,7 @@ tags:
   - SamSam Ransomware
   - Ryuk Ransomware
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3

stories/active_directory_lateral_movement.yml

@@ -1,19 +1,20 @@
-name: Lateral Movement
+name: Active Directory Lateral Movement
 id: 399d65dc-1f08-499b-a259-aad9051f38ad
-version: 2
-date: '2021-11-23'
+version: 3
+date: '2021-12-09'
 author: David Dorsey, Mauricio Velazco Splunk
 description: Detect and investigate tactics, techniques, and procedures around how
-  attackers move laterally within the enterprise. Because lateral movement can expose
-  the adversary to detection, it should be an important focus for security analysts.
+  attackers move laterally within an Active Directory environment. Since lateral movement 
+  is often a necessary step in a breach, it is important for cyber defenders to deploy 
+  detection coverage.
 narrative: "Once attackers gain a foothold within an enterprise, they will seek to\
   \ expand their accesses and leverage techniques that facilitate lateral movement.\
   \ Attackers will often spend quite a bit of time and effort moving laterally. Because\
   \ lateral movement renders an attacker the most vulnerable to detection, it's an\
   \ excellent focus for detection and investigation.\\\nIndications of lateral movement\
-  \ can include the abuse of system utilities (such as `psexec.exe`), unauthorized\
-  \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash,\
-  \ or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\
+  \ in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized\
+  \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager,\
+  \ the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\
   \ lateral movement techniques and look for suspicious activity in and around high-value\
   \ strategic network assets, such as Active Directory, which are often considered\
   \ the primary target or \"crown jewels\" to a persistent threat actor.\\\nAn adversary\
@@ -32,9 +33,9 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek
   \ for all processes to ensure that the attackers did not install unauthorized software."
 references:
 - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
-- https://www.youtube.com/watch?v=hVTkkkM9XDg
+- http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco
 tags:
-  analytic_story: Lateral Movement
+  analytic_story: Active Directory Lateral Movement
   category:
   - Adversary Tactics
   product:

tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml

@@ -0,0 +1,12 @@
+name: Possible Lateral Movement PowerShell Spawn Unit Test
+tests:
+- name: Possible Lateral Movement PowerShell Spawn
+  file: endpoint/possible_lateral_movement_powershell_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/short_lived_scheduled_task.test.yml

@@ -0,0 +1,12 @@
+name: Short Lived Scheduled Task Unit Test
+tests:
+- name: Short Lived Scheduled Task
+  file: endpoint/short_lived_scheduled_task.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog