From 14f9bea86568d0e5ea635481f3bae40b2bec09b2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 11:39:40 -0600
Subject: [PATCH] mwc hunting and rundll32 fix

---
 ...ous_microsoft_workflow_compiler_rename.yml |  6 +--
 ...undll32_with_no_command_line_arguments.yml | 42 +++++++++----------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index cc3bcf8312..0127c45b1a 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -1,9 +1,9 @@
 name: Suspicious microsoft workflow compiler rename
 id: f0db4464-55d9-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
+version: 3
+date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index 4b0ed41df7..d657c6c6f8 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -1,25 +1,23 @@
 name: Suspicious Rundll32 no Command Line Arguments
 id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
-version: 1
-date: '2021-02-09'
+version: 2
+date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies rundll32.exe with no command line arguments.
   It is unusual for rundll32.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. Rundll32.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE)
-  | regex CommandLine="(rundll32\.exe.{0,4}$)" | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
-  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_rundll32` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -69,14 +67,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - process_path
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint