updated another 30

2026-06-08 17:32:49 +00:00 · 2023-08-21 15:12:49 -07:00
parent 5e2ef49278
commit 10cb1816bb
31 changed files with 64 additions and 86 deletions
@@ -5,7 +5,7 @@ date: '2022-06-01'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: this search is designed to detect suspicious wermgr.exe process that
+description: This search is designed to detect suspicious wermgr.exe process that
  tries to connect to known IP web services. This technique is know for trickbot and
  other trojan spy malware to recon the infected machine and look for its ip address
  without so much finger print on the commandline process. Since wermgr.exe is designed
@@ -19,7 +19,7 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism
  "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org",
  "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net")
  |  stats  min(_time) as firstTime max(_time) as lastTime count by Image process_name
-  ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)`
+  ProcessId QueryName QueryStatus QueryResults Computer EventCode | rename Computer as dest| `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, dns query name process path , and query ststus from
@@ -35,12 +35,12 @@ tags:
  asset_type: Endpoint
  confidence: 80
  impact: 70
-  message: Wermgr.exe process connecting IP location web services on $ComputerName$
+  message: Wermgr.exe process connecting IP location web services on $dest$
  mitre_attack_id:
  - T1590
  - T1590.005
  observable:
-  - name: ComputerName
+  - name: dest
    type: Endpoint
    role:
    - Victim
@@ -17,8 +17,8 @@ data_source:
 search: '`sysmon` EventCode=10  TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*")
  AND GrantedAccess = 0x1040 AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program
  File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as
-  lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId
-  TargetProcessId GrantedAccess CallTrace | `security_content_ctime(firstTime)` |
+  lastTime by Computer SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId
+  TargetProcessId GrantedAccess CallTrace | rename Computer as dest| `security_content_ctime(firstTime)` |
  `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
@@ -35,13 +35,12 @@ tags:
  asset_type: Endpoint
  confidence: 70
  impact: 70
-  message: a process $SourceImage$ is duplicating the handle token of winlogon.exe
-    in $Computer$
+  message: A process $SourceImage$ is duplicating the handle token of winlogon.exe on $dest$
  mitre_attack_id:
  - T1134.001
  - T1134
  observable:
-  - name: Computer
+  - name: dest
    type: Endpoint
    role:
    - Victim
@@ -14,7 +14,7 @@ description: The following analytic identifies the addition of a Service Princip
 search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
  | transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674") endswith=(EventCode=5136 OperationType="%%14675")
  | eval short_lived=case((duration<300),"TRUE") 
-  | search short_lived = TRUE
+  | search short_lived = TRUE | rename ObjectDN as user
  | `windows_ad_short_lived_domain_account_serviceprincipalname_filter`'
 how_to_implement: To successfully implement this search, you ned to be ingesting eventcode 
 `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` 
@@ -32,15 +32,11 @@ tags:
  asset_type: Endpoint
  confidence: 80
  impact: 50
-  message: A Servince Principal Name for $ObjectDN$ was set and shortly deleted
+  message: A Servince Principal Name for $user$ was set and shortly deleted
  mitre_attack_id:
  - T1098
  observable:
-  - name: SubjectUserName
-    type: User
-    role:
-    - Attacker
-  - name: ObjectDN
+  - name: user
    type: User
    role:
    - Victim
@@ -14,7 +14,7 @@ data_source:
 - Powershell 4104
 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-Clipboard*" | stats count
  min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
-  user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  UserID | rename Computer as dest | rename UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_clipboard_data_via_get_clipboard_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -31,16 +31,15 @@ tags:
  asset_type: Endpoint
  confidence: 50
  impact: 50
-  message: powershell script $ScriptBlockText$ execute Get-Clipboard commandlet in
-    $dest$
+  message: Powershell script $ScriptBlockText$ execute Get-Clipboard commandlet on $dest$
  mitre_attack_id:
  - T1115
  observable:
-  - name: Computer
+  - name: dest
    type: Hostname
    role:
    - Victim
-  - name: UserID
+  - name: user
    type: User
    role:
    - Victim
@@ -43,7 +43,7 @@ tags:
    type: User
    role:
    - Victim
-  - name: Computer
+  - name: dest
    type: Hostname
    role:
    - Victim
@@ -15,7 +15,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
  WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*")
-  BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name
  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `windows_defender_exclusion_registry_entry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -37,7 +37,7 @@ tags:
  asset_type: Endpoint
  confidence: 80
  impact: 80
-  message: exclusion registry $registry_path$  modified or added on $dest$
+  message: Exclusion registry $registry_path$ modified or added on $dest$ for Windows Defender
  mitre_attack_id:
  - T1562.001
  - T1562
@@ -18,7 +18,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
  WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword"
-  Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
+  Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.dest Registry.registry_path
  Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`'
@@ -14,7 +14,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
  WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
-  Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
+  Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.dest Registry.user Registry.registry_path
  Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`'
@@ -19,7 +19,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
  WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
  Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data
-  = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name
+  = "0x00000001") BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name
  Registry.registry_value_name Registry.registry_value_data Registry.process_guid
  | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`'
@@ -38,8 +38,7 @@ tags:
  asset_type: Endpoint
  confidence: 100
  impact: 90
-  message: A process $process_name$ was identified attempting to disable memory crash
-    dumps on $dest$.
+  message: A process was identified attempting to disable memory crash dumps on $dest$.
  mitre_attack_id:
  - T1485
  observable:
@@ -51,14 +50,6 @@ tags:
    type: Hostname
    role:
    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -14,7 +14,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
  WHERE (Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data
-  = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name
+  = "0x00000001") BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name
  Registry.registry_value_name Registry.registry_value_data Registry.process_guid
  | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_notification_center_filter`'
@@ -17,7 +17,7 @@ data_source:
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
  WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
  Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
-  Registry.registry_value_data = "0x00000001")) BY _time span=1h Registry.registry_path
+  Registry.registry_value_data = "0x00000001")) BY _time span=1h Registry.dest Registry.user Registry.registry_path
  Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`'
@@ -14,7 +14,7 @@ description: This analytic is to detect a suspicious registry modification to di
  allowed doing this is needed.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
  | `drop_dm_object_name(Registry)`
  | where isnotnull(registry_value_data)
  | `security_content_ctime(firstTime)` 
@@ -38,7 +38,7 @@ tags:
  asset_type: Endpoint
  confidence: 70
  impact: 70
-  message: Registry modification to disable windows features on $dest$
+  message: Registry modification to disable windows group policy features on $dest$
  mitre_attack_id:
  - T1112
  observable:
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.process_path
  IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*",
  "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by
-  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
  Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `is_net_windows_file` | `windows_dotnet_binary_in_non_standard_path_filter`'
@@ -14,7 +14,7 @@ description:
 data_source:
  - Sysmon Event ID 7
 search: '`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" NOT (ImagePath IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*"))
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType | rename Computer as dest
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `windows_driver_load_non_standard_path_filter`'
@@ -38,12 +38,12 @@ tags:
  asset_type: Endpoint
  confidence: 60
  impact: 60
-  message: A kernel mode driver was loaded from a non-standard path on $ComputerName$.
+  message: A kernel mode driver was loaded from a non-standard path on $dest$.
  mitre_attack_id:
    - T1014
    - T1068
  observable:
-    - name: ComputerName
+    - name: dest
      type: Endpoint
      role:
        - Victim
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
  WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
  Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork",
  "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") BY
-  _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name
  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -51,7 +51,7 @@ tags:
    type: User
    role:
    - Victim
-  - name: Computer
+  - name: dest
    type: Hostname
    role:
    - Victim
@@ -24,7 +24,7 @@ data_source:
 - Sysmon Event ID 7
 search: '`sysmon` EventCode=7  parent_process_name=installutil.exe ImageLoaded IN
  ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time)
-  as lastTime by Computer, parent_process_name, ImageLoaded, OriginalFileName, ProcessId
+  as lastTime by Computer, parent_process_name, ImageLoaded, OriginalFileName, ProcessId, user
  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_installutil_credential_theft_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -40,7 +40,7 @@ tags:
  asset_type: Endpoint
  confidence: 100
  impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  message: An instance of $parent_process_name$ spawning $ImageLoaded$ was identified
    on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially
    capture credentials in memory.
  mitre_attack_id:
@@ -59,10 +59,6 @@ tags:
    type: Process
    role:
    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path
  IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*",
  "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by
-  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
  Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash
  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_installutil_in_non_standard_path_filter`'
@@ -28,7 +28,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
  | `security_content_ctime(lastTime)` | join  process_id [| tstats `security_content_summariesonly`
  count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port !=
  0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)`
-  | rename dest as C2 ] | table _time dest parent_process_name process_name process_path
+  | rename dest as C2 ] | table _time user dest parent_process_name process_name process_path
  process process_id dest_port C2 | `windows_installutil_remote_network_connection_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
@@ -27,12 +27,12 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
-  span=1h  Processes.process_id Processes.process_name Processes.dest Processes.process_path
+  span=1h  Processes.user Processes.process_id Processes.process_name Processes.dest Processes.process_path
  Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_id
  [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
  where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port
-  | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name
+  | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest parent_process_name
  process_name process_path process process_id dest_port C2 | `windows_installutil_uninstall_option_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
@@ -11,7 +11,7 @@ description: The following analytic identifies the default service name created
 data_source:
 - Sysmon Event ID 7
 search: '`wineventlog_system` EventCode=7045 Service_Name IN ("KrbSCM") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name
+  min(_time) as firstTime max(_time) as lastTime by dest EventCode Service_File_Name Service_Name
  Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_krbrelayup_service_creation_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -50,7 +50,7 @@ tags:
    type: User
    role:
    - Victim
-  - name: Computer
+  - name: dest
    type: Hostname
    role:
    - Victim
@@ -40,11 +40,11 @@ tags:
  asset_type: Endpoint
  confidence: 70
  impact: 70
-  message: An increase of Windows Modify Registry behavior has been detected on $affected_systems$
+  message: An increase of Windows Modify Registry behavior has been detected on $risk_object$
  mitre_attack_id:
  - T1112
  observable:
-  - name: affected_systems
+  - name: risk_object
    type: Hostname
    role:
    - Victim
@@ -16,7 +16,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
  WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*"
-  AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip")) BY _time span=1h
+  AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip")) BY _time span=1h Registry.dest Registry.user
  Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
@@ -50,7 +50,7 @@ tags:
    type: User
    role:
    - Victim
-  - name: Computer
+  - name: dest
    type: Hostname
    role:
    - Victim
@@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_data
  = "*mshta*" OR Registry.registry_value_data IN ("*javascript:*", "*vbscript:*","*WScript.Shell*")
  by Registry.registry_key_name Registry.registry_path Registry.registry_value_data
-  Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.action Registry.dest Registry.user| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `windows_mshta_execution_in_registry_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
  that records registry activity from your hosts to populate the endpoint data model
@@ -37,7 +37,7 @@ tags:
  asset_type: Endpoint
  confidence: 90
  impact: 80
-  message: a registry $registry_path$ contains mshta $registry_value_data$ in $dest$
+  message: A registry $registry_path$ contains mshta $registry_value_data$ in $dest$
  mitre_attack_id:
  - T1218.005
  observable:
@@ -11,13 +11,13 @@ description: The following analytic identifies MSIExec with any network connecti
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_msiexec` by _time Processes.process_id Processes.process_name Processes.dest
+  where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name Processes.dest
  Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_id
  [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
  where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest
  All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ]
-  | table _time dest parent_process_name process_name process_path process process_id
+  | table _time user dest parent_process_name process_name process_path process process_id
  dest_port dest_ip | `windows_msiexec_with_network_connections_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
@@ -37,7 +37,7 @@ tags:
  confidence: 50
  impact: 70
  message: An instance of $process_name$ was identified on endpoint $dest$ contacting
-    a remote destination.
+    a remote destination $dest_ip$
  mitre_attack_id:
  - T1218.007
  observable:
@@ -35,7 +35,7 @@ references:
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" | bucket
  span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName)
-  as tried_accounts by _time, ProcessName, SubjectUserName, Computer | where unique_accounts
+  as tried_accounts by _time, ProcessName, SubjectUserName, Computer | rename Computer as dest | where unique_accounts
  > 30 | `windows_multiple_users_failed_to_authenticate_from_process_filter`'
 status: production
 tags:
@@ -46,12 +46,12 @@ tags:
  asset_type: Endpoint
  confidence: 70
  impact: 70
-  message: Potential password spraying attack from $Computer$
+  message: Potential password spraying attack from $dest$
  mitre_attack_id:
  - T1110.003
  - T1110
  observable:
-  - name: ComputerName
+  - name: dest
    role:
    - Victim
    type: Endpoint
@@ -36,7 +36,7 @@ references:
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" | bucket
  span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName)
-  as tried_accounts by _time, IpAddress, Computer | where unique_accounts > 30 | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` '
+  as tried_accounts by _time, IpAddress, Computer | rename Computer as dest| where unique_accounts > 30 | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` '
 status: production
 tags:
  analytic_story:
@@ -45,12 +45,12 @@ tags:
  asset_type: Endpoint
  confidence: 70
  impact: 70
-  message: Potential password spraying attack on $ComputerName$
+  message: Potential password spraying attack on $dest$
  mitre_attack_id:
  - T1110.003
  - T1110
  observable:
-  - name: ComputerName
+  - name: dest
    role:
    - Victim
    type: Endpoint
@@ -5,8 +5,7 @@ date: '2023-05-25'
 author: Steven Dick
 status: production
 type: TTP
-description: >-
-  The following analytic identifies when a suspicious certificate is granted using Active Directory Certificate Services (AD CS) with a Subject Alternative Name (SAN) and then immediately used for authentication. This action alone may not be malicious, however improperly configured certificate templates can be abused to permit privilege escalation and environment compromise due to over permissive settings (AD CS ESC1).
+description: The following analytic identifies when a suspicious certificate is granted using Active Directory Certificate Services (AD CS) with a Subject Alternative Name (SAN) and then immediately used for authentication. This action alone may not be malicious, however improperly configured certificate templates can be abused to permit privilege escalation and environment compromise due to over permissive settings (AD CS ESC1).
 data_source:
  - Windows Security 4887
  - Windows Security 4768
@@ -21,21 +20,19 @@ search: >-
  | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name
  | eval user = lower(coalesce(req_user_1,req_user_2)) 
  | join user
-      [
-      | search `wineventlog_security` EventCode=4768 CertThumbprint=*
-      | rename TargetUserName as user, Computer as auth_dest, IpAddress as auth_src
-      | fields auth_src,auth_dest,user
-      ]
+  [
+  | search `wineventlog_security` EventCode=4768 CertThumbprint=*
+  | rename TargetUserName as user, Computer as auth_dest, IpAddress as auth_src
+  | fields auth_src,auth_dest,user
+  ]
  | eval src = upper(coalesce(auth_src,req_src)), dest = upper(coalesce(auth_dest,req_dest_1,req_dest_2)), risk_score = 90
  | eval flavor_text = case(signature_id=="4887", "User account [".'user'."] authenticated after a suspicious certificate was issued for it by [".'src_user'."] using certificate request ID: ".'ssl_serial')
  | fields - req_* auth_*
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `windows_steal_authentication_certificates___esc1_authentication_filter`
-how_to_implement: >-
-  To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum.
-known_false_positives: >-
-  False positives may be generated in environments where administrative users or processes are allowed to generate certificates with Subject Alternative Names for authentication. Sources or templates used in these processes may need to be tuned out for accurate function.
+how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum.
+known_false_positives: False positives may be generated in environments where administrative users or processes are allowed to generate certificates with Subject Alternative Names for authentication. Sources or templates used in these processes may need to be tuned out for accurate function.
 references:
  - https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
  - https://github.com/ly4k/Certipy#esc1
@@ -46,7 +43,7 @@ tags:
  asset_type: Endpoint
  confidence: 90
  impact: 100
-  message: Possible AD CS ESC1 authentication - $flavor_text$
+  message: Possible AD CS ESC1 authentication on $dest$
  mitre_attack_id:
    - T1649
    - T1550