Merge branch 'AD_Discovery_TR-789_2' of https://github.com/splunk/security_content into AD_Discovery_TR-789_2

detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml

@@ -6,18 +6,20 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. 
-  This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or 
-  specific information that admin may look upon this is still a good TTP to alert some malicious activities.
-search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" 
- | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
- | `security_content_ctime(firstTime)`
- | `security_content_ctime(lastTime)`  
- | `getwmiobject_ds_user_with_powershell_script_block_filter`'
-how_to_implement: he following Hunting analytic requires PowerShell operational logs to be imported. 
-  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
-  or PowerShell Script Block Logging.
-known_false_positives: not commonly seen as a normal command from network admin but possible noise may exist.
+description: This search is to detect a powershell command get-wmiobject function
+  to do user enumeration to the active directory. This command can be a normal query
+  of a network admin but since the output of this is not so much structure and cannot
+  give a concrete or specific information that admin may look upon this is still a
+  good TTP to alert some malicious activities.
+search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*"
+  Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
+how_to_implement: he following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: not commonly seen as a normal command from network admin but
+  possible noise may exist.
 references:
 - https://www.blackhillsinfosec.com/red-blue-purple/
 - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace
@@ -37,13 +39,12 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message 
-  - ComputerName 
+  - Message
+  - ComputerName
   - User
   security_domain: endpoint
   impact: 50
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
   context:
   - source:endpoint
@@ -58,4 +59,4 @@ tags:
     type: User
     role:
     - Victim
-  
+  automated_detection_testing: passed