From 34107ac322a4e447786f026dbd1e738e3a1af536 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Feb 2022 14:29:40 -0700
Subject: [PATCH] update to certutil urlcache and verifyctl

---
 ...ertutil_download_with_urlcache_and_split_arguments.yml | 8 ++++----
 ...rtutil_download_with_verifyctl_and_split_arguments.yml | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index af05ba2894..20168a30e2 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -1,7 +1,7 @@
 name: CertUtil Download With URLCache and Split Arguments
 id: 415b4306-8bfb-11eb-85c4-acde48001122
-version: 2
-date: '2021-03-23'
+version: 3
+date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -14,8 +14,8 @@ description: Certutil.exe may download a file from a remote destination using `-
   During triage, capture any files on disk and review. Review the reputation of the
   remote IP or domain in question.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache*
-  Processes.process=*split* by Processes.dest Processes.user Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
+  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.original_file_name
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index d35aa4fa46..65fef131a1 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -1,7 +1,7 @@
 name: CertUtil Download With VerifyCtl and Split Arguments
 id: 801ad9e4-8bfb-11eb-8b31-acde48001122
-version: 2
-date: '2021-03-23'
+version: 3
+date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -14,8 +14,8 @@ description: 'Certutil.exe may download a file from a remote destination using `
   the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl*
-  Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
+  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'