From 833001dd15d17bc03ab05c5e30c7361840f283ef Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 9 Aug 2021 14:19:27 -0600
Subject: [PATCH 001/153] Update suspicious_rundll32_rename.yml

---
 .../endpoint/suspicious_rundll32_rename.yml   | 25 +++++++++++--------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index 0a3a03e50f..861b13f859 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -1,25 +1,28 @@
 name: Suspicious Rundll32 Rename
 id: 7360137f-abad-473e-8189-acbdaa34d114
-version: 1
+version: 2
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: batch
-datamodel: []
+datamodel:
+- Endpoint
 description: The following analytic identifies renamed instances of rundll32.exe executing.
   rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
   investigation, validate it is the legitimate rundll32.exe executing and what script
   content it is loading. This query relies on the OriginalFileName from Sysmon, or
   internal name from the PE meta data. Expand the query as needed by looking for specific
   command line arguments outlined in other analytics.
-search: '`sysmon` EventID=1 OriginalFileName=RUNDLL32.EXE NOT process_name=rundll32.exe
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `suspicious_rundll32_rename_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=RUNDLL32.exe AND Processes.process_name!=rundll32.exe)
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_rename_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:

From 6a99bcffa853ab5c729840c0250aea6b3f6a292a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 10 Aug 2021 12:26:39 -0600
Subject: [PATCH 002/153] Added detection testing service results inDetect
 Renamed rundll32.exe Rename

---
 detections/endpoint/suspicious_rundll32_rename.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index 861b13f859..277556e88f 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -13,13 +13,11 @@ description: The following analytic identifies renamed instances of rundll32.exe
   internal name from the PE meta data. Expand the query as needed by looking for specific
   command line arguments outlined in other analytics.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=RUNDLL32.exe AND Processes.process_name!=rundll32.exe)
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `suspicious_rundll32_rename_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=RUNDLL32.exe
+  AND Processes.process_name!=rundll32.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_rundll32_rename_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.

From 6a81b49ae985cb54868fde51c4d925e4ed13d097 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 10 Aug 2021 12:37:22 -0600
Subject: [PATCH 003/153] Update suspicious_msbuild_rename.yml

---
 .../endpoint/suspicious_msbuild_rename.yml    | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 29d7a24179..85b90859fe 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -4,20 +4,23 @@ version: 1
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: batch
-datamodel: []
+datamodel: 
+- Endpoint
 description: The following analytic identifies renamed instances of msbuild.exe executing.
   Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
-search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe process_name!=msbuild.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `suspicious_msbuild_rename_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=msbuild.exe AND Processes.process_name!=msbuild.exe)
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `suspicious_msbuild_rename_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of msbuild, triggering a false positive.
 references:

From 668fba767bf37012862fddc368a0011b82a9cb8a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 10 Aug 2021 13:28:55 -0600
Subject: [PATCH 004/153] Update suspicious_msbuild_rename.yml

---
 detections/endpoint/suspicious_msbuild_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 85b90859fe..82aa79ab49 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -11,7 +11,7 @@ description: The following analytic identifies renamed instances of msbuild.exe
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=msbuild.exe AND Processes.process_name!=msbuild.exe)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=MSBuild.exe AND Processes.process_name!=msbuild.exe)
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
   | `drop_dm_object_name(Processes)` 

From dcd72f2f67a3b736bb6edcb14ec13c05da49f0e2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 10 Aug 2021 14:31:04 -0600
Subject: [PATCH 005/153] Update suspicious_msbuild_rename.yml

---
 detections/endpoint/suspicious_msbuild_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 82aa79ab49..4f7d6a469c 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -11,7 +11,7 @@ description: The following analytic identifies renamed instances of msbuild.exe
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=MSBuild.exe AND Processes.process_name!=msbuild.exe)
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=MSBuild.exe Processes.process_name!=msbuild.exe
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
   | `drop_dm_object_name(Processes)` 

From 87e23caa401a567771e8f8cc26cb90269fe59a31 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 06:38:49 -0600
Subject: [PATCH 006/153] Update suspicious_rundll32_startw.yml

---
 detections/endpoint/suspicious_rundll32_startw.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index a6f99d08af..7b587eb12f 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -16,7 +16,8 @@ description: The following analytic identifies rundll32.exe executing a DLL func
   rundll32.exe is the default process it opens and injects shellcode into. This default
   process can be changed, but typically is not.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=RUNDLL32.exe
+  OR Processes.process_name=rundll32.exe)
   Processes.process=*start* by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

From cf669e8deb84653d5d36e48a35cf8eb57acebc8d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 07:25:28 -0600
Subject: [PATCH 007/153] Added detection testing service results inSuspicious
 Rundll32 startw

---
 detections/endpoint/suspicious_rundll32_startw.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index 7b587eb12f..fa8e13e783 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -17,11 +17,10 @@ description: The following analytic identifies rundll32.exe executing a DLL func
   process can be changed, but typically is not.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=RUNDLL32.exe
-  OR Processes.process_name=rundll32.exe)
-  Processes.process=*start* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `suspicious_rundll32_startw_filter`'
+  OR Processes.process_name=rundll32.exe) Processes.process=*start* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_startw_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.

From 749fbff290c8737270d9302d0335cdbf6f412be6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 07:39:30 -0600
Subject: [PATCH 008/153] Update detect_renamed_rclone.yml

---
 detections/endpoint/detect_renamed_rclone.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml
index 24d59a4971..bc8ac8ccad 100644
--- a/detections/endpoint/detect_renamed_rclone.yml
+++ b/detections/endpoint/detect_renamed_rclone.yml
@@ -11,10 +11,12 @@ description: The following analytic identifies the usage of `rclone.exe`, rename
   the legitimate site and executed accordingly. During triage, isolate the endpoint
   and begin to review parallel processes for additional behavior. At this stage, the
   adversary may have staged data to be exfiltrated.
-search: '`sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=rclone.exe
+  AND Processes.process_name!=rclone.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `detect_renamed_rclone_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your

From 005cfcc40edf6a596a67375c707854f8e63dee26 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 08:25:46 -0600
Subject: [PATCH 009/153] Added detection testing service results inDetect
 Renamed RClone


From ca96ea558fa209425942d4a7e9414c3cfa34e632 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 08:34:05 -0600
Subject: [PATCH 010/153] Update detect_renamed_psexec.yml

---
 detections/endpoint/detect_renamed_psexec.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 489a239822..555845f302 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -12,15 +12,15 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
   usage. During triage, validate this is the legitimate version of `PsExec` by review
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
-search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
-  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=psexec.c Processes.process_name!=psexec.exe Processes.process_name!=PsExec64.exe by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: Limited false positives should be present. It is possible some
   third party applications may use older versions of PsExec, filter as needed.
 references:

From eed6b40e5fc955aa09b93dcb903210d395aecda2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 09:24:31 -0600
Subject: [PATCH 011/153] Added detection testing service results inDetect
 Renamed PSExec

---
 detections/endpoint/detect_renamed_psexec.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 555845f302..3b68da3b0c 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -13,10 +13,11 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   usage. During triage, validate this is the legitimate version of `PsExec` by review
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=psexec.c Processes.process_name!=psexec.exe Processes.process_name!=PsExec64.exe by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=psexec.c
+  Processes.process_name!=psexec.exe Processes.process_name!=PsExec64.exe by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.original_file_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

From 8458ce2eb454000928ef6f6b3df2a76013f724f4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 09:34:41 -0600
Subject: [PATCH 012/153] Update detect_renamed_winrar.yml

---
 detections/endpoint/detect_renamed_winrar.yml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index fced19564c..2b6d0b7ea6 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -12,15 +12,16 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
   In this instance, we are using `OriginalFileName` from Sysmon to determine if the
   process is WinRAR. During triage, validate additional metadata from the binary that
   this is `WinRAR`. Review parallel processes and file modifications.
-search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
-  process_name!=winrar.exe | stats count min(_time) as firstTime max(_time) as lastTime
-  by Computer, User, parent_process_name, process_name, OriginalFileName, process_path,
-  CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Modify query for specific EDR products as needed.
+search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe
+  AND Processes.process_name!=rar.exe Processes.process_name!=winrar.exe by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_renamed_winrar_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: Unknown. It is possible third party applications use renamed
   instances of WinRAR.
 references:

From d13b923f91caebedfaf0ee53cc56508fa5972e2a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 10:26:48 -0600
Subject: [PATCH 013/153] Update detect_renamed_winrar.yml

---
 detections/endpoint/detect_renamed_winrar.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 2b6d0b7ea6..e233131ac4 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -14,7 +14,7 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
   this is `WinRAR`. Review parallel processes and file modifications.
 search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe
-  AND Processes.process_name!=rar.exe Processes.process_name!=winrar.exe by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name!=rar.exe Processes.process_name!=winrar.exe by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`

From a864bdc8428738fa86e3514123745571347d0cb6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 11:23:42 -0600
Subject: [PATCH 014/153] Update detect_renamed_7_zip.yml

---
 detections/endpoint/detect_renamed_7_zip.yml | 24 ++++++++++++--------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index 15b9ae62ad..5e8c1892fa 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -9,15 +9,21 @@ datamodel:
 description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
   this stage of an attack, review parallel processes and file modifications for data
   that is staged or potentially have been exfiltrated. This analytic utilizes the
-  OriginalFileName to capture the renamed process.
-search: '`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe) |
-  stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
-  process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+  OriginalFileName to capture the renamed process. 
+  During triage, validate this is the legitimate version of `7zip` by reviewing
+  the PE metadata. In addition, review parallel processes for further suspicious behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=7z*.exe
+  AND Processes.process_name!=7z*.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_renamed_7_zip_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: Limited false positives, however this analytic will need to
   be modified for each environment if Sysmon is not used.
 references:

From 2317ee7a4b8d42ddf083f2863b4d877ef3163ad9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 12:08:08 -0600
Subject: [PATCH 015/153] Added detection testing service results inDetect
 Renamed 7-Zip

---
 detections/endpoint/detect_renamed_7_zip.yml | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index 5e8c1892fa..16a94aa7d5 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -9,18 +9,15 @@ datamodel:
 description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
   this stage of an attack, review parallel processes and file modifications for data
   that is staged or potentially have been exfiltrated. This analytic utilizes the
-  OriginalFileName to capture the renamed process. 
-  During triage, validate this is the legitimate version of `7zip` by reviewing
-  the PE metadata. In addition, review parallel processes for further suspicious behavior.
+  OriginalFileName to capture the renamed process. During triage, validate this is
+  the legitimate version of `7zip` by reviewing the PE metadata. In addition, review
+  parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=7z*.exe
   AND Processes.process_name!=7z*.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_renamed_7_zip_filter`'
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.

From b450921fa1e781cf7db1272d8b679f320e3e67eb Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 13:47:34 -0600
Subject: [PATCH 016/153] Update
 suspicious_microsoft_workflow_compiler_rename.yml

---
 ...picious_microsoft_workflow_compiler_rename.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index fd7170c6e8..5f869f4206 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -4,18 +4,21 @@ version: 1
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: batch
-datamodel: []
+datamodel:
+- Endpoint
 description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
   Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
   and is rarely utilized. When investigating, identify the executed code on disk and
   review. A spawned child process from microsoft.workflow.compiler.exe is uncommon.
   In any instance, microsoft.workflow.compiler.exe spawning from an Office product
   or any living off the land binary is highly suspect.
-search: '`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `suspicious_microsoft_workflow_compiler_rename_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe
+  AND Processes.process_name!=microsoft.workflow.compiler.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `suspicious_microsoft_workflow_compiler_rename_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

From 56714c68cdbc57b889b46b766872be2f5a1c0edd Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 15:01:09 -0600
Subject: [PATCH 017/153] Update detect_html_help_renamed.yml

---
 .../endpoint/detect_html_help_renamed.yml     | 45 ++++++++++---------
 1 file changed, 25 insertions(+), 20 deletions(-)

diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 60aa2a26bb..34270cf3b2 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -1,10 +1,11 @@
 name: Detect HTML Help Renamed
 id: 62fed254-513b-460e-953d-79771493a9f3
-version: 1
+version: 2
 date: '2021-02-11'
 author: Michael Haag, Splunk
 type: batch
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -16,14 +17,16 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
   or WSH script code. During investigation, identify script content origination. Validate
   it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '`sysmon` EventID=1 OriginalFileName=HH.exe NOT process_name=hh.exe | stats
-  count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
-  process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed hh.exe may be used.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe.mui
+  AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_html_help_renamed_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used
   legitimately, filter as needed.
 references:
@@ -46,8 +49,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Actions on Objectives
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$.
+  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
   mitre_attack_id:
   - T1218.001
   nist:
@@ -76,13 +78,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - OriginalFileName
-  - process_name
-  - Computer
-  - User
-  - parent_process_name
-  - process_path
-  - CommandLine
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint

From bf673e9d1a6652e2225c0d6d54993e4b682a8189 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 15:57:22 -0600
Subject: [PATCH 018/153] Update detect_html_help_renamed.yml

---
 detections/endpoint/detect_html_help_renamed.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 34270cf3b2..9864d74ac2 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -18,7 +18,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
   it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe.mui
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe
   AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name 

From c6f4791a1b8427c150a9598ed7d3b4e582e682f1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 19:51:53 -0600
Subject: [PATCH 019/153] Update
 suspicious_microsoft_workflow_compiler_rename.test.yml

broken test
---
 .../suspicious_microsoft_workflow_compiler_rename.test.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml b/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
index eecb9688ea..c119db0da6 100644
--- a/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
+++ b/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From f7bb6e308d83ca4983f8c47bc00d405bb6f015f8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 11 Aug 2021 20:32:46 -0600
Subject: [PATCH 020/153] Added detection testing service results inDetect HTML
 Help Renamed

---
 .../endpoint/detect_html_help_renamed.yml     | 26 ++++++++++---------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 9864d74ac2..4e4b474520 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -5,7 +5,7 @@ date: '2021-02-11'
 author: Michael Haag, Splunk
 type: batch
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -21,12 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe
   AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_html_help_renamed_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used
   legitimately, filter as needed.
 references:
@@ -49,7 +50,8 @@ tags:
   impact: 80
   kill_chain_phases:
   - Actions on Objectives
-  message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$.
   mitre_attack_id:
   - T1218.001
   nist:
@@ -80,11 +82,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 8397af16736f6be0034bcb4c14ce9183ff12e4cb Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 05:46:36 -0600
Subject: [PATCH 021/153] Update
 suspicious_microsoft_workflow_compiler_usage.yml

---
 ...ious_microsoft_workflow_compiler_usage.yml | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 4523b56a1e..621e2d5c07 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -1,6 +1,6 @@
 name: Suspicious microsoft workflow compiler usage
 id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: batch
@@ -12,8 +12,8 @@ description: The following analytic identifies microsoft.workflow.compiler.exe u
   review. It is not a commonly used process by many applications.
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe
-  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe OR Processes.process_name=microsoft.workflow.compiler.exe)
+  by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -34,8 +34,6 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  - Stage:Execution
-  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
   impact: 70
@@ -62,10 +60,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
-  - Processes.parent_process
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint

From a2f9ac969c9b7da6c03e48291ba2e09a353b9330 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 06:32:45 -0600
Subject: [PATCH 022/153] Added detection testing service results inDetect
 microsoft.workflow.compiler.exe rename

---
 .../suspicious_microsoft_workflow_compiler_rename.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index 5f869f4206..78f7e26675 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -14,11 +14,10 @@ description: The following analytic identifies a renamed instance of microsoft.w
   or any living off the land binary is highly suspect.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe
-  AND Processes.process_name!=microsoft.workflow.compiler.exe) by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `suspicious_microsoft_workflow_compiler_rename_filter`'
+  AND Processes.process_name!=microsoft.workflow.compiler.exe) by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_rename_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -44,7 +43,7 @@ tags:
   - Stage:Execution
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log
   impact: 70
   kill_chain_phases:
   - Exploitation

From f538e37f09944f842ccabbe8ac0d3ffee9a661a4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 06:40:52 -0600
Subject: [PATCH 023/153] Update detect_mshta_renamed.yml

---
 detections/endpoint/detect_mshta_renamed.yml | 38 ++++++++++----------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index b789c2e0f2..a94346b29b 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -1,6 +1,6 @@
 name: Detect mshta renamed
 id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-20'
 author: Michael Haag, Splunk
 type: batch
@@ -10,15 +10,14 @@ description: The following analytic identifies renamed instances of mshta.exe ex
   analytic utilizes the internal name of the PE to identify if is the legitimate mshta
   binary. Further analysis should be performed to review the executed content and
   validation it is the real mshta.
-search: '`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `detect_mshta_renamed_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=mshta.exe
+  AND Processes.process_name!=mshta.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_mshta_renamed_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of mshta.exe, but never renamed, triggering a false positive.
 references:
@@ -70,13 +69,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - OriginalFileName
-  - process_name
-  - Computer
-  - User
-  - parent_process_name
-  - process_path
-  - CommandLine
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint

From 14e55880cd1226a252760efb9f0fd0e3c4c9b68f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 07:27:44 -0600
Subject: [PATCH 024/153] mwc fix

---
 .../suspicious_microsoft_workflow_compiler_usage.yml   | 10 ++++++----
 ...spicious_microsoft_workflow_compiler_usage.test.yml |  2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 621e2d5c07..27b0c0cc3c 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -10,11 +10,13 @@ description: The following analytic identifies microsoft.workflow.compiler.exe u
   microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
   and is rarely utilized. When investigating, identify the executed code on disk and
   review. It is not a commonly used process by many applications.
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
-  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe OR Processes.process_name=microsoft.workflow.compiler.exe)
-  by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.user | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
+  by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.user 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `suspicious_microsoft_workflow_compiler_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
diff --git a/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml b/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml
index 6593f91cb4..b81b1c6d9f 100644
--- a/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml
+++ b/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

From a49702a9fe1706c4794217e5c6c5c7f9822416da Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 08:23:22 -0600
Subject: [PATCH 025/153] Added detection testing service results inDetect
 microsoft.workflow.compiler.exe usage

---
 ...ious_microsoft_workflow_compiler_usage.yml | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 27b0c0cc3c..efd77d0460 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -11,11 +11,10 @@ description: The following analytic identifies microsoft.workflow.compiler.exe u
   and is rarely utilized. When investigating, identify the executed code on disk and
   review. It is not a commonly used process by many applications.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe OR Processes.process_name=microsoft.workflow.compiler.exe)
-  by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.user 
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe
+  OR Processes.process_name=microsoft.workflow.compiler.exe) by Processes.dest Processes.parent_process
+  Processes.process_name Processes.original_file_name Processes.process Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_microsoft_workflow_compiler_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -37,7 +36,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log
   impact: 70
   kill_chain_phases:
   - Exploitation
@@ -64,11 +63,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 3576abc8c0793bafd9c3c6db4859791907c154cd Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 08:55:39 -0600
Subject: [PATCH 026/153] psexec and startw fix

---
 detections/endpoint/detect_renamed_psexec.yml      | 7 +++----
 detections/endpoint/suspicious_rundll32_startw.yml | 2 +-
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 3b68da3b0c..42cf27f9a9 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -1,6 +1,6 @@
 name: Detect Renamed PSExec
 id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 1
+version: 2
 date: '2021-05-19'
 author: Michael Haag, Splunk
 type: batch
@@ -9,12 +9,11 @@ datamodel:
 description: The following analytic identifies renamed instances of `PsExec.exe` being
   utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe`
   or other SysInternal utility usage with the command-line argument of `-accepteula`.
-  In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
-  usage. During triage, validate this is the legitimate version of `PsExec` by review
+  During triage, validate this is the legitimate version of `PsExec` by reviewing
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=psexec.c
-  Processes.process_name!=psexec.exe Processes.process_name!=PsExec64.exe by Processes.dest
+  (Processes.process_name!=psexec.exe OR Processes.process_name!=PsExec64.exe) by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index fa8e13e783..b34cc8bda4 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -1,6 +1,6 @@
 name: Suspicious Rundll32 StartW
 id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
-version: 1
+version: 2
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: batch

From 31b5dc53b3c6a59c953f650c58ca3d5eba2e0efa Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 08:55:58 -0600
Subject: [PATCH 027/153] Update detect_renamed_psexec.yml

---
 detections/endpoint/detect_renamed_psexec.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 42cf27f9a9..9b09bb9c7f 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -18,9 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives should be present. It is possible some
   third party applications may use older versions of PsExec, filter as needed.
 references:

From 104e8b352615cc579a6abcfb40d16df22c128b24 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 09:43:50 -0600
Subject: [PATCH 028/153] Added detection testing service results inDetect
 Renamed PSExec

---
 detections/endpoint/detect_renamed_psexec.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 9b09bb9c7f..5078d75311 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -13,12 +13,16 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=psexec.c
-  (Processes.process_name!=psexec.exe OR Processes.process_name!=PsExec64.exe) by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id Processes.original_file_name |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  (Processes.process_name!=psexec.exe OR Processes.process_name!=PsExec64.exe) by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives should be present. It is possible some
   third party applications may use older versions of PsExec, filter as needed.
 references:

From fc58b0fe694f5e7729eadc58e37da91f3e51a905 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 09:53:42 -0600
Subject: [PATCH 029/153] Update detect_renamed_winrar.yml

---
 detections/endpoint/detect_renamed_winrar.yml | 37 +++++++++----------
 1 file changed, 18 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index e233131ac4..2297e44a53 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -1,6 +1,6 @@
 name: Detect Renamed WinRAR
 id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
-version: 1
+version: 2
 date: '2021-05-19'
 author: Michael Haag, Splunk
 type: batch
@@ -9,19 +9,15 @@ datamodel:
 description: The following analtyic identifies renamed instances of `WinRAR.exe`.
   In most cases, it is not common for WinRAR to be used renamed, however it is common
   to be installed by a third party application and executed from a non-standard path.
-  In this instance, we are using `OriginalFileName` from Sysmon to determine if the
-  process is WinRAR. During triage, validate additional metadata from the binary that
+  During triage, validate additional metadata from the binary that
   this is `WinRAR`. Review parallel processes and file modifications.
-search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe
-  Processes.process_name!=rar.exe Processes.process_name!=winrar.exe by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe (Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `detect_renamed_winrar_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Unknown. It is possible third party applications use renamed
   instances of WinRAR.
 references:
@@ -67,13 +63,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint

From 86e78db19ae70814179bf703dcbdaad605b2bc13 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 10:41:19 -0600
Subject: [PATCH 030/153] Added detection testing service results inDetect
 Renamed WinRAR

---
 detections/endpoint/detect_renamed_winrar.yml | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 2297e44a53..8c2ae6d95f 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -9,15 +9,20 @@ datamodel:
 description: The following analtyic identifies renamed instances of `WinRAR.exe`.
   In most cases, it is not common for WinRAR to be used renamed, however it is common
   to be installed by a third party application and executed from a non-standard path.
-  During triage, validate additional metadata from the binary that
-  this is `WinRAR`. Review parallel processes and file modifications.
+  During triage, validate additional metadata from the binary that this is `WinRAR`.
+  Review parallel processes and file modifications.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe (Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe
+  (Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.original_file_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_winrar_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Unknown. It is possible third party applications use renamed
   instances of WinRAR.
 references:
@@ -65,11 +70,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 1e6e1c795eb5c18195456d5078c47beae2ee4fff Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 10:52:48 -0600
Subject: [PATCH 031/153] Update suspicious_msbuild_rename.yml

---
 .../endpoint/suspicious_msbuild_rename.yml    | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 4f7d6a469c..44fb677f87 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -1,6 +1,6 @@
 name: Suspicious MSBuild Rename
 id: 4006adac-5937-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: batch
@@ -11,16 +11,14 @@ description: The following analytic identifies renamed instances of msbuild.exe
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=MSBuild.exe Processes.process_name!=msbuild.exe
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=MSBuild.exe AND Processes.process_name!=msbuild.exe)
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `suspicious_msbuild_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of msbuild, triggering a false positive.
 references:
@@ -69,13 +67,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - OriginalFileName
-  - process_name
-  - Computer
-  - User
-  - parent_process_name
-  - process_path
-  - CommandLine
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint

From ed971abfac9799d1871ae19c48d741f703166e8c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 12 Aug 2021 14:06:59 -0600
Subject: [PATCH 032/153] Update detect_sharphound_usage.yml

---
 .../endpoint/detect_sharphound_usage.yml      | 43 ++++++++++---------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index c97ebf6a5b..8871a8934b 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -1,28 +1,28 @@
 name: Detect SharpHound Usage
 id: dd04b29a-beed-11eb-87bc-acde48001122
-version: 1
+version: 2
 date: '2021-05-27'
 author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
 description: The following analytic identifies SharpHound binary usage by using the
-  `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is
-  available to detect command-line arguments. This particular analytic only looks
-  for the OriginalFileName of `SharpHound.exe`. It is possible older instances of
+  `OriginalFileName`. In addition to renaming the PE, other coverage is
+  available to detect command-line arguments. This particular analytic looks
+  for the OriginalFileName of `SharpHound.exe` and the process name. It is possible older instances of
   SharpHound.exe have different original filenames. Dependent upon the operator, the
   code may be re-compiled and the attributes removed or changed to anything else.
   During triage, review the metadata of the binary in question. Review parallel processes
   for suspicious behavior. Identify the source of this binary.
-search: '`sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
-  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sharphound.exe OR Processes.original_file_name=SharpHound.exe)
+  Processes.process=*start* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `detect_sharphound_usage_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited as this is specific to a
   file attribute not used by anything else. Filter as needed.
 references:
@@ -63,13 +63,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 24
   security_domain: endpoint

From b099bac0d917581d2eed3b7694d5f7c7b27e762d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 13 Aug 2021 13:19:05 -0600
Subject: [PATCH 033/153] Update detect_sharphound_usage.yml

---
 detections/endpoint/detect_sharphound_usage.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index 8871a8934b..50888e84de 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -16,7 +16,7 @@ description: The following analytic identifies SharpHound binary usage by using
   for suspicious behavior. Identify the source of this binary.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sharphound.exe OR Processes.original_file_name=SharpHound.exe)
-  Processes.process=*start* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`

From 4d0223b62e83e0a1b2cd966ae9de966015339239 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 13 Aug 2021 15:09:24 -0600
Subject: [PATCH 034/153] Added detection testing service results inDetect
 SharpHound Usage

---
 .../endpoint/detect_sharphound_usage.yml      | 40 ++++++++++---------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index 50888e84de..7e926e9433 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -7,22 +7,24 @@ type: batch
 datamodel:
 - Endpoint
 description: The following analytic identifies SharpHound binary usage by using the
-  `OriginalFileName`. In addition to renaming the PE, other coverage is
-  available to detect command-line arguments. This particular analytic looks
-  for the OriginalFileName of `SharpHound.exe` and the process name. It is possible older instances of
-  SharpHound.exe have different original filenames. Dependent upon the operator, the
-  code may be re-compiled and the attributes removed or changed to anything else.
-  During triage, review the metadata of the binary in question. Review parallel processes
-  for suspicious behavior. Identify the source of this binary.
+  `OriginalFileName`. In addition to renaming the PE, other coverage is available
+  to detect command-line arguments. This particular analytic looks for the OriginalFileName
+  of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe
+  have different original filenames. Dependent upon the operator, the code may be
+  re-compiled and the attributes removed or changed to anything else. During triage,
+  review the metadata of the binary in question. Review parallel processes for suspicious
+  behavior. Identify the source of this binary.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sharphound.exe OR Processes.original_file_name=SharpHound.exe)
-  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_sharphound_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sharphound.exe
+  OR Processes.original_file_name=SharpHound.exe) by Processes.dest Processes.user
+  Processes.parent_process_name Processes.original_file_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives should be limited as this is specific to a
   file attribute not used by anything else. Filter as needed.
 references:
@@ -65,11 +67,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 20000828f37be2979209261f03f5c272d40949e6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 11:15:36 -0600
Subject: [PATCH 035/153] Macro'd powershell

---
 .../endpoint/any_powershell_downloadfile.yml  | 23 ++++++++--------
 .../any_powershell_downloadstring.yml         | 23 ++++++++--------
 .../endpoint/excel_spawning_powershell.yml    | 25 ++++++++---------
 ...connect_to_internet_with_hidden_window.yml | 26 +++++++++---------
 ...s_powershell_process___encoded_command.yml | 25 ++++++++---------
 ...hell_process___execution_policy_bypass.yml | 25 ++++++++---------
 ...ll_process_with_obfuscation_techniques.yml | 27 ++++++++++---------
 .../endpoint/nishang_powershelltcponeline.yml | 21 ++++++++-------
 ...powershell_disable_security_monitoring.yml | 21 ++++++++-------
 .../powershell_start_bitstransfer.yml         | 24 ++++++++++-------
 detections/endpoint/w3wp_spawning_shell.yml   | 22 ++++++++-------
 ...cess_spawned_cmd_or_powershell_process.yml | 24 ++++++++---------
 .../endpoint/winword_spawning_powershell.yml  | 27 ++++++++++---------
 macros/process_powershell.yml                 |  3 +++
 macros/process_wmic.yml                       |  3 +++
 15 files changed, 171 insertions(+), 148 deletions(-)
 create mode 100644 macros/process_powershell.yml
 create mode 100644 macros/process_wmic.yml

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index fb300e8bdd..f437b1c003 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -1,6 +1,6 @@
 name: Any Powershell DownloadFile
 id: 1a93b7ea-7af7-11eb-adb5-acde48001122
-version: 1
+version: 2
 date: '2021-03-01'
 author: Michael Haag, Splunk
 type: batch
@@ -12,15 +12,12 @@ description: The following analytic identifies the use of PowerShell downloading
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe
-  OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
   Processes.process=*DownloadFile* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `any_powershell_downloadfile_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present and filtering will need to occur
   by parent process or command line argument. It may be required to modify this query
   to an EDR product for more granular coverage.
@@ -69,14 +66,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 4c29d3578f..e924270a02 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -1,6 +1,6 @@
 name: Any Powershell DownloadString
 id: 4d015ef2-7adf-11eb-95da-acde48001122
-version: 1
+version: 2
 date: '2021-03-01'
 author: Michael Haag, Splunk
 type: batch
@@ -12,15 +12,12 @@ description: The following analytic identifies the use of PowerShell downloading
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
-  OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
   Processes.process=*.DownloadString*  by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `any_powershell_downloadstring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present and filtering will need to occur
   by parent process or command line argument. It may be required to modify this query
   to an EDR product for more granular coverage.
@@ -68,14 +65,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml
index c34fe1fd57..8312e7dc0f 100644
--- a/detections/endpoint/excel_spawning_powershell.yml
+++ b/detections/endpoint/excel_spawning_powershell.yml
@@ -15,13 +15,10 @@ description: The following detection identifies Microsoft Excel spawning PowerSh
   and identify any files that may have been written.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe",
-  "pwsh.exe")  by Processes.parent_process Processes.process_name Processes.user Processes.dest
+  where Processes.parent_process_name="excel.exe" `process_powershell` by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.original_file_name
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `excel_spawning_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
@@ -66,12 +63,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
index a5c99d373c..d2b5118772 100644
--- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
@@ -1,6 +1,6 @@
 name: Malicious PowerShell Process - Connect To Internet With Hidden Window
 id: ee18ed37-0802-4268-9435-b3b91aaa18db
-version: 5
+version: 6
 date: '2020-11-20'
 author: David Dorsey, Splunk
 type: batch
@@ -14,16 +14,12 @@ description: This search looks for PowerShell processes started with parameters
   download file with System.Net.WebClient.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
   Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*"
-  by Processes.user Processes.process_name Processes.parent_process_name Processes.process
+  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.process
   Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
 references: []
@@ -77,10 +73,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.user
-  - Processes.parent_process_name
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index cbea88edfd..1a89d9b1ab 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -1,6 +1,6 @@
 name: Malicious PowerShell Process - Encoded Command
 id: c4db14d9-7909-48b4-a054-aa14d89dbb19
-version: 4
+version: 5
 date: '2020-07-21'
 author: David Dorsey, Splunk
 type: batch
@@ -10,16 +10,12 @@ description: This search looks for PowerShell processes that have encoded the sc
   within the command-line. Malware has been seen using this parameter, as it obfuscates
   the code and makes it relatively easy to pass a script on the command-line.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = powershell.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
   (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user
-  Processes.process_name Processes.process Processes.parent_process_name Processes.dest
+  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest
   Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: System administrators may use this option, but it's not common.
 references: []
 tags:
@@ -62,11 +58,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.user
-  - Processes.parent_process_name
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index b13814575a..abb54b0ae8 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -1,6 +1,6 @@
 name: Malicious PowerShell Process - Execution Policy Bypass
 id: 9be56c82-b1cc-4318-87eb-d138afaaca39
-version: 4
+version: 5
 date: '2020-07-21'
 author: Rico Valdez, Mauricio Velazco, Splunk
 type: batch
@@ -13,14 +13,10 @@ description: This search looks for PowerShell processes started with parameters
 search: '| tstats `security_content_summariesonly` values(Processes.process_id) as
   process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process)
   as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name=powershell.exe (Processes.process="* -ex*" OR Processes.process="*
+  where `process_powershell` (Processes.process="* -ex*" OR Processes.process="*
   bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: There may be legitimate reasons to bypass the PowerShell execution
   policy. The PowerShell script being run with this parameter should be validated
   to ensure that it is legitimate.
@@ -65,11 +61,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.process
-  - Processes.process_name
-  - Processes.user
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
index 504b3bfe69..6a3cb132cb 100644
--- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
+++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
@@ -1,6 +1,6 @@
 name: Malicious PowerShell Process With Obfuscation Techniques
 id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4
-version: 4
+version: 5
 date: '2021-01-19'
 author: David Dorsey, Splunk
 type: batch
@@ -10,17 +10,13 @@ description: This search looks for PowerShell processes launched with arguments
   have characters indicative of obfuscation on the command-line.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
-  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
+  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest
   Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1)
   + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter`
   | search num_obfuscation > 10 '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: These characters might be legitimately on the command-line,
   but it is not common.
 references: []
@@ -63,11 +59,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.user
-  - Processes.parent_process_name
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index b95183fa98..d128e6f954 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -1,6 +1,6 @@
 name: Nishang PowershellTCPOneLine
 id: 1a382c6c-7c2e-11eb-ac69-acde48001122
-version: 1
+version: 2
 date: '2021-03-03'
 author: Michael Haag, Splunk
 type: batch
@@ -13,15 +13,13 @@ description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility
   suspicious. Review the reputation of the remote IP or domain contacted by the powershell
   process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
   OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
   (Processes.process=*Net.Sockets.TCPClient* AND Processes.process=*System.Text.ASCIIEncoding*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives may be present. Filter as needed based
   on initial analysis.
 references:
@@ -57,13 +55,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
index ec33904c56..8399bc7544 100644
--- a/detections/endpoint/powershell_disable_security_monitoring.yml
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -1,6 +1,6 @@
 name: Powershell Disable Security Monitoring
 id: c148a894-dd93-11eb-bf2a-acde48001122
-version: 1
+version: 2
 date: '2021-07-05'
 author: Michael Haag, Splunk
 type: batch
@@ -10,15 +10,12 @@ description: This search is to identifies a modification in registry to disable
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe",
-  "pwsh.exe", "sqlps.exe", "sqltoolsps.exe") Processes.process="*set-mppreference*"
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*"
   AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*")
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives. However, tune based on scripts that
   may perform this action.
 references:
@@ -42,9 +39,13 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml
index a751befad5..5ba82c9720 100644
--- a/detections/endpoint/powershell_start_bitstransfer.yml
+++ b/detections/endpoint/powershell_start_bitstransfer.yml
@@ -1,6 +1,6 @@
 name: PowerShell Start-BitsTransfer
 id: 39e2605a-90d8-11eb-899e-acde48001122
-version: 1
+version: 2
 date: '2021-03-29'
 author: Michael Haag, Splunk
 type: batch
@@ -14,14 +14,12 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si
   processes and process lineage. Capture any files on disk and review. For the remote
   domain or IP, what is the reputation?
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
   Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_start_bitstransfer_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives. It is possible administrators will
   utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
   process or command-line arguments.
@@ -61,10 +59,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.user
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index ad9d5ff8bb..6887de98eb 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -1,6 +1,6 @@
 name: W3WP Spawning Shell
 id: 0f03423c-7c6a-11eb-bc47-acde48001122
-version: 1
+version: 2
 date: '2021-03-03'
 author: Michael Haag, Splunk
 type: batch
@@ -17,12 +17,10 @@ description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=w3wp.exe
-  AND Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe by Processes.dest
-  Processes.parent_process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  AND Processes.process_name=cmd.exe OR `process_powershell` by Processes.dest
+  Processes.parent_process Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Baseline your environment before production. It is possible
   build systems using IIS will spawn cmd.exe to perform a software build. Filter as
   needed.
@@ -56,10 +54,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
index 8a2a5def5f..0bced96c97 100644
--- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
@@ -1,6 +1,6 @@
 name: Wermgr Process Spawned CMD Or Powershell Process
 id: e8fc95bc-a107-11eb-a978-acde48001122
-version: 1
+version: 2
 date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: batch
@@ -13,14 +13,11 @@ description: This search is designed to detect suspicious cmd and powershell pro
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe"
-  OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id  Processes.process_name
+  OR `process_powershell` by Processes.parent_process_name  Processes.original_file_name Processes.parent_process_id  Processes.process_name
   Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wermgr_process_spawned_cmd_or_powershell_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
@@ -52,13 +49,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process_id
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_guid
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml
index 74c32cca3d..2b0735ae97 100644
--- a/detections/endpoint/winword_spawning_powershell.yml
+++ b/detections/endpoint/winword_spawning_powershell.yml
@@ -1,6 +1,6 @@
 name: Winword Spawning PowerShell
 id: b2c950b8-9be2-11eb-8658-acde48001122
-version: 1
+version: 2
 date: '2021-04-12'
 author: Michael Haag, Splunk
 type: batch
@@ -15,13 +15,11 @@ description: The following detection identifies Microsoft Word spawning PowerShe
   and identify any files that may have been written.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe"
-  Processes.process_name IN ("powershell.exe", "pwsh.exe") by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  `process_powershell` by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
@@ -65,11 +63,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
diff --git a/macros/process_powershell.yml b/macros/process_powershell.yml
new file mode 100644
index 0000000000..e90bfb853e
--- /dev/null
+++ b/macros/process_powershell.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_powershell
\ No newline at end of file
diff --git a/macros/process_wmic.yml b/macros/process_wmic.yml
new file mode 100644
index 0000000000..b00eb60a1c
--- /dev/null
+++ b/macros/process_wmic.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_wmic
\ No newline at end of file

From 9958c82c3c719f0325479f460ca2a54d91edfb5a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 11:44:30 -0600
Subject: [PATCH 036/153] macro'd wmic

---
 .../endpoint/office_product_spawning_wmic.yml | 27 ++++++++++---------
 .../process_kill_base_on_file_path.yml        | 23 ++++++++--------
 .../remote_process_instantiation_via_wmi.yml  | 26 +++++++++---------
 .../endpoint/remote_wmi_command_attempt.yml   | 10 +++----
 macros/process_cmd.yml                        |  3 +++
 5 files changed, 47 insertions(+), 42 deletions(-)
 create mode 100644 macros/process_cmd.yml

diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml
index 5cd338d813..586a4399fb 100644
--- a/detections/endpoint/office_product_spawning_wmic.yml
+++ b/detections/endpoint/office_product_spawning_wmic.yml
@@ -1,6 +1,6 @@
 name: Office Product Spawning Wmic
 id: ffc236d6-a6c9-11eb-95f1-acde48001122
-version: 1
+version: 2
 date: '2021-04-26'
 author: Michael Haag, Splunk
 type: TTP
@@ -18,13 +18,11 @@ description: The following detection identifies the latest behavior utilized by
   activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=wmic.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_wmic`
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name 
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
@@ -62,11 +60,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml
index dae9291127..64c8fa1486 100644
--- a/detections/endpoint/process_kill_base_on_file_path.yml
+++ b/detections/endpoint/process_kill_base_on_file_path.yml
@@ -1,6 +1,6 @@
 name: Process Kill Base On File Path
 id: 5ffaa42c-acdb-11eb-9ad3-acde48001122
-version: 1
+version: 2
 date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -11,15 +11,11 @@ description: The following analytic identifies the use of `wmic.exe` using `dele
   stages of an adversary setting up for mining on an endpoint.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name =
-  "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*"
-  AND Processes.process="*delete*" by  Processes.parent_process_name Processes.process_name
+  as lastTime  from datamodel=Endpoint.Processes where `process_wmic` AND Processes.process="*process*" AND Processes.process="*executablepath*"
+  AND Processes.process="*delete*" by  Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed wmic.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Unknown.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -55,11 +51,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
   - Processes.dest
   - Processes.user
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 3c252ef4b5..3add5539d9 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -1,24 +1,20 @@
 name: Remote Process Instantiation via WMI
 id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
-version: 5
+version: 6
 date: '2020-11-30'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for wmic.exe being launched with parameters to spawn
+description: This analytic identifies wmic.exe being launched with parameters to spawn
   a process on a remote system.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = wmic.exe Processes.process="*/node*" Processes.process="*process*"
-  Processes.process="*call*" Processes.process="*create*"   by Processes.process_name
+  where `process_wmic` Processes.process="*/node*" Processes.process="*process*"
+  Processes.process="*call*" Processes.process="*create*"   by Processes.process_name Processes.original_file_name
   Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: The wmic.exe utility is a benign Windows application. It may
   be used legitimately by Administrators with these parameters for remote system administration,
   but it's relatively uncommon.
@@ -65,10 +61,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
index d93b796850..ced2e45c67 100644
--- a/detections/endpoint/remote_wmi_command_attempt.yml
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -1,6 +1,6 @@
 name: Remote WMI Command Attempt
 id: 272df6de-61f1-4784-877c-1fbc3e2d0838
-version: 3
+version: 4
 date: '2018-12-03'
 author: Rico Valdez, Michael Haag, Splunk
 type: TTP
@@ -12,16 +12,12 @@ description: The following analytic identifies usage of `wmic.exe` spawning a lo
   and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm
   execution or file modifications. Contain and isolate the endpoint as needed.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic`
   Processes.process=*node* by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `remote_wmi_command_attempt_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. Deprecated because duplicate of Remote Process Instantiation via WMI.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Deprecated because duplicate of Remote Process Instantiation via WMI.
 known_false_positives: Administrators may use this legitimately to gather info from
   remote systems. Filter as needed.
 references:
diff --git a/macros/process_cmd.yml b/macros/process_cmd.yml
new file mode 100644
index 0000000000..6eb5b05fed
--- /dev/null
+++ b/macros/process_cmd.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_cmd
\ No newline at end of file

From 644747d578600035cd0dc956219b3492dedf38e2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 12:09:31 -0600
Subject: [PATCH 037/153] macro'd reg cmd

---
 ...dential_dump_from_registry_via_reg_exe.yml | 22 ++++++-------
 .../endpoint/cmd_echo_pipe___escalation.yml   | 19 +++++-------
 ...f_shadow_copy_with_wmic_and_powershell.yml | 12 +++----
 ...ping_via_copy_command_from_shadow_copy.yml | 11 +++----
 ...ohibited_applications_spawning_cmd_exe.yml | 14 ++++-----
 .../office_product_spawn_cmd_process.yml      | 27 +++++++++-------
 ...previously_seen_command_line_arguments.yml | 25 +++++++++------
 ...rsive_delete_of_directory_in_batch_cmd.yml | 23 +++++++-------
 ...ll32_create_remote_thread_to_a_process.yml |  2 +-
 .../endpoint/suspicious_reg_exe_process.yml   | 31 ++++++++++---------
 detections/endpoint/w3wp_spawning_shell.yml   |  2 +-
 ...cess_spawned_cmd_or_powershell_process.yml |  2 +-
 detections/endpoint/winword_spawning_cmd.yml  | 25 ++++++++-------
 macros/process_reg.yml                        |  3 ++
 14 files changed, 113 insertions(+), 105 deletions(-)
 create mode 100644 macros/process_reg.yml

diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index 619694db3c..1b09691d37 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -1,6 +1,6 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-version: 4
+version: 5
 date: '2019-12-02'
 author: Patrick Bareiss, Splunk
 type: TTP
@@ -9,17 +9,13 @@ datamodel:
 description: Monitor for execution of reg.exe with parameters specifying an export
   of keys that contain hashed credentials that attackers may try to crack offline.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe
-  OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
+  as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
   OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
   OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: None identified.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
@@ -73,10 +69,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml
index 492e5135ae..c66bdad8c2 100644
--- a/detections/endpoint/cmd_echo_pipe___escalation.yml
+++ b/detections/endpoint/cmd_echo_pipe___escalation.yml
@@ -1,6 +1,6 @@
 name: CMD Echo Pipe - Escalation
 id: eb277ba0-b96b-11eb-b00e-acde48001122
-version: 1
+version: 2
 date: '2021-05-20'
 author: Michael Haag, Splunk
 type: TTP
@@ -11,14 +11,11 @@ description: This analytic identifies a common behavior by Cobalt Strike and oth
   Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will
   look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe
-  OR Processes.process=*%comspec%*) (Processes.process=*echo* AND Processes.process=*pipe*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR Processes.process=*%comspec%* (Processes.process=*echo* AND Processes.process=*pipe*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Unknown. It is possible filtering may be required to ensure
   fidelity.
 references:
@@ -69,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index e0ea0631b8..299dd423fd 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -1,6 +1,6 @@
 name: Creation of Shadow Copy with wmic and powershell
 id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
-version: 1
+version: 2
 date: '2019-12-10'
 author: Patrick Bareiss, Splunk
 type: TTP
@@ -9,13 +9,11 @@ datamodel:
 description: This search detects the use of wmic and Powershell to create a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic*
-  OR Processes.process_name=powershell* Processes.process=*shadowcopy* Processes.process=*create*
-  by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic`
+  OR `process_powershell` Processes.process=*shadowcopy* Processes.process=*create*
+  by Processes.user Processes.process_name Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index 4dc778c475..ffdf93a927 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -1,6 +1,6 @@
 name: Credential Dumping via Copy Command from Shadow Copy
 id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
-version: 1
+version: 2
 date: '2019-12-10'
 author: Patrick Bareiss, Splunk
 type: TTP
@@ -9,16 +9,13 @@ datamodel:
 description: This search detects credential dumping using copy command from a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
   (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security*
   OR Processes.process=*\\system32\\config\\system* OR Processes.process=*\\windows\\ntds\\ntds.dit*)
-  by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process
+  by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
index defebaf20c..9eb85d6d3b 100644
--- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,6 +1,6 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: dcfd6b40-42f9-469d-a433-2e53f7486664
-version: 5
+version: 6
 date: '2020-11-10'
 author: Bhavin Patel, Splunk
 type: Hunting
@@ -10,14 +10,14 @@ description: This search looks for executions of cmd.exe spawned by a process th
   is often abused by attackers and that does not typically launch cmd.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name
+  where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts and populates the Endpoint data model with the resultant dataset. This search
   includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
   of processes that should not be spawning cmd.exe. You can modify this lookup to
-  better suit your environment.
+  better suit your environment. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: There are circumstances where an application may legitimately
   execute and interact with the Windows command-line interface. Investigate and modify
   the lookup file, as appropriate.
@@ -73,11 +73,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml
index 2a70599ab2..24342a2e97 100644
--- a/detections/endpoint/office_product_spawn_cmd_process.yml
+++ b/detections/endpoint/office_product_spawn_cmd_process.yml
@@ -1,6 +1,6 @@
 name: Office Product Spawn CMD Process
 id: b8b19420-e892-11eb-9244-acde48001122
-version: 1
+version: 2
 date: '2021-07-19'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -14,14 +14,11 @@ description: this search is to detect a suspicious office product process that s
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
-  = "powerpnt.exe") Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
+  = "powerpnt.exe") `process_cmd` by Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest Processes.original_file_name
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `office_product_spawn_cmd_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: IT or network admin may create an document automation that
   will run shell script.
 references:
@@ -57,10 +54,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - parent_process
-  - process_name
-  - process
-  - process_id
-  - process_guid
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/previously_seen_command_line_arguments.yml b/detections/endpoint/previously_seen_command_line_arguments.yml
index 30262b84d7..dc9d36642a 100644
--- a/detections/endpoint/previously_seen_command_line_arguments.yml
+++ b/detections/endpoint/previously_seen_command_line_arguments.yml
@@ -1,6 +1,6 @@
 name: Previously seen command line arguments
 id: 56059acf-50fe-4f60-98d1-b75b51b5c2f3
-version: 2
+version: 3
 date: '2019-03-01'
 author: Bhavin Patel, Splunk
 type: Baseline
@@ -10,13 +10,9 @@ description: This search looks for command-line arguments where `cmd.exe /c` is
   to execute a program, then creates a baseline of the earliest and latest times we
   have encountered this command-line argument in our dataset within the last 30 days.
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
-  AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must be ingesting
-  logs with both the process name and command line from your endpoints. The complete
-  process name with command-line arguments are mapped to the "process" field in the
-  Endpoint data model.
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
+  AND Processes.process="* /c *" by Processes.process Processes.original_file_name| `drop_dm_object_name(Processes)`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: none
 references: []
 tags:
@@ -40,6 +36,15 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
index 4fe458d6da..22511aa7c3 100644
--- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
@@ -1,6 +1,6 @@
 name: Recursive Delete of Directory In Batch CMD
 id: ba570b3a-d356-11eb-8358-acde48001122
-version: 1
+version: 2
 date: '2021-06-22'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -11,15 +11,12 @@ description: This search is to detect a suspicious commandline designed to delet
   (reddot) where it it tries to delete the files in recycle bin to impaire user from
   recovering deleted files.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
   Processes.process=*/c*  Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*"
   by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process
   Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: network operator may use this batch command to delete recursively
   a directory or files within directory
 references:
@@ -40,11 +37,15 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_id
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
index 566e7ea365..42016f00b1 100644
--- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
+++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
-  process to cmd.exe process . This technique was seen in IcedID malware to execute
+  process to cmd.exe process. This technique was seen in IcedID malware to execute
   its malicious code in normal process for defense evasion and to steal sensitive
   information the the compromised host. browser process.
 search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe"
diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index 95e24b7f34..8b476054fc 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -1,28 +1,25 @@
 name: Suspicious Reg exe Process
 id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
-version: 4
+version: 5
 date: '2020-07-22'
 author: David Dorsey, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: This search looks for reg.exe being launched from a command prompt not
   started by the user. When a user launches cmd.exe, the parent process is usually
   explorer.exe. This search filters out those instances.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name
-  != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name
-  Processes.parent_process_name Processes.dest Processes.process_id Processes.parent_process_id
+  != explorer.exe `process_cmd` by Processes.user Processes.process_name
+  Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | search [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe by Processes.parent_process_id
-  Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  where Processes.parent_process_name=cmd.exe `process_reg` by Processes.parent_process_id
+  Processes.dest Processes.process_name Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | rename parent_process_id as process_id |dedup
   process_id| table process_id dest] | `suspicious_reg_exe_process_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: It's possible for system administrators to write scripts that
   exhibit this behavior. If this is the case, the search will need to be modified
   to filter them out.
@@ -68,12 +65,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.user
-  - Processes.parent_process_name
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 02bbf44552..21fad31dce 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -17,7 +17,7 @@ description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=w3wp.exe
-  AND Processes.process_name=cmd.exe OR `process_powershell` by Processes.dest
+  AND `process_cmd` OR `process_powershell` by Processes.dest
   Processes.parent_process Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
index 622c5789a2..52ed919ba2 100644
--- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
@@ -12,7 +12,7 @@ description: This search is designed to detect suspicious cmd and powershell pro
   to run malicious behavior.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe"
+  where Processes.parent_process_name = "wermgr.exe" `process_cmd`
   OR `process_powershell` by Processes.parent_process_name  Processes.original_file_name Processes.parent_process_id  Processes.process_name
   Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml
index 24c829f571..9e530c2845 100644
--- a/detections/endpoint/winword_spawning_cmd.yml
+++ b/detections/endpoint/winword_spawning_cmd.yml
@@ -1,6 +1,6 @@
 name: Winword Spawning Cmd
 id: 6fcbaedc-a37b-11eb-956b-acde48001122
-version: 1
+version: 2
 date: '2021-04-22'
 author: Michael Haag, Splunk
 type: TTP
@@ -16,13 +16,11 @@ description: The following detection identifies Microsoft Word spawning `cmd.exe
   child process to `explorer.exe` or `wmiprvse.exe`.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winword.exe
-  Processes.process_name=cmd.exe by Processes.dest Processes.user Processes.parent_process
+  `process_cmd` by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `winword_spawning_cmd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
@@ -63,11 +61,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
diff --git a/macros/process_reg.yml b/macros/process_reg.yml
new file mode 100644
index 0000000000..60260af606
--- /dev/null
+++ b/macros/process_reg.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_reg
\ No newline at end of file

From 3251fcc1f6259798bae3c3cc30ea6c948473b0fa Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 13:21:24 -0600
Subject: [PATCH 038/153] macrod rundll32

---
 ...2_application_control_bypass___advpack.yml | 20 +++++++------
 ..._application_control_bypass___setupapi.yml | 16 ++++++----
 ..._application_control_bypass___syssetup.yml | 20 +++++++------
 .../detect_rundll32_inline_hta_execution.yml  | 25 +++++++++-------
 .../endpoint/drop_icedid_license_dat.yml      |  2 +-
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   | 21 ++++++-------
 .../enable_rdp_in_other_port_number.yml       |  2 +-
 ..._spawning_rundll32_or_regsvr32_process.yml | 25 +++++++++-------
 ...ice_application_spawn_rundll32_process.yml | 21 ++++++-------
 ..._product_spawning_rundll32_with_no_dll.yml | 25 +++++++++-------
 ...no_command_line_arguments_with_network.yml | 24 ++++++++-------
 .../rundll_loading_dll_by_ordinal.yml         | 22 +++++++-------
 .../endpoint/spoolsv_spawning_rundll32.yml    | 18 ++++++-----
 .../suspicious_icedid_rundll32_cmdline.yml    | 28 ++++++++---------
 .../suspicious_rundll32_dllregisterserver.yml | 20 +++++++------
 .../suspicious_rundll32_plugininit.yml        | 30 +++++++++----------
 .../endpoint/suspicious_rundll32_rename.yml   | 28 ++++++++---------
 .../endpoint/suspicious_rundll32_startw.yml   | 21 ++++++-------
 macros/process_rundll32.yml                   |  3 ++
 19 files changed, 202 insertions(+), 169 deletions(-)
 create mode 100644 macros/process_rundll32.yml

diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
index f6656f2726..7bdfa29e18 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -1,6 +1,6 @@
 name: Detect Rundll32 Application Control Bypass - advpack
 id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
-version: 1
+version: 2
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
@@ -16,14 +16,12 @@ description: The following analytic identifies rundll32.exe loading advpack.dll
   investigation, review any network connections and obtain the script content executed.
   It's possible other files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
+  Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_rundll32_application_control_bypass___advpack_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use advpack.dll
   or ieadvpack.dll, triggering a false positive.
 references:
@@ -81,10 +79,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
index c896aefbad..534d700493 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
@@ -1,6 +1,6 @@
 name: Detect Rundll32 Application Control Bypass - setupapi
 id: 61e7b44a-6088-4f26-b788-9a96ba13b37a
-version: 1
+version: 2
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
@@ -16,8 +16,8 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll
   investigation, review any network connections and obtain the script content executed.
   It's possible other files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
+  Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_rundll32_application_control_bypass___setupapi_filter`'
@@ -81,10 +81,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
index d8c73721ea..1a619f65f6 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
@@ -1,6 +1,6 @@
 name: Detect Rundll32 Application Control Bypass - syssetup
 id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
-version: 1
+version: 2
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
@@ -16,14 +16,12 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll
   any network connections and obtain the script content executed. It's possible other
   files are on disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
+  Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_rundll32_application_control_bypass___syssetup_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll,
   triggering a false positive.
 references:
@@ -81,10 +79,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index 564cd45a31..f1b9e3b985 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -1,6 +1,6 @@
 name: Detect Rundll32 Inline HTA Execution
 id: 91c79f14-5b41-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-20'
 author: Michael Haag, Splunk
 type: TTP
@@ -15,14 +15,12 @@ description: The following analytic identifies "rundll32.exe" execution with inl
   "rundll32.exe" and its parent process.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
   (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*)
-  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
+  by Processes.user Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_rundll32_inline_hta_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
@@ -65,11 +63,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.user
   - Processes.dest
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml
index f2eca3393b..aae789e878 100644
--- a/detections/endpoint/drop_icedid_license_dat.yml
+++ b/detections/endpoint/drop_icedid_license_dat.yml
@@ -16,7 +16,7 @@ search: '`sysmon` EventCode= 11  TargetFilename = "*\\license.dat" AND (TargetFi
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+  Sysmon TA. 
 known_false_positives: unknown
 references:
 - https://www.cisecurity.org/white-papers/security-primer-icedid/
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index 18a5223a05..c3c5a1499d 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -1,6 +1,6 @@
 name: Dump LSASS via comsvcs DLL
 id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
-version: 1
+version: 2
 date: '2020-02-21'
 author: Patrick Bareiss, Splunk
 type: TTP
@@ -8,14 +8,11 @@ datamodel:
 - Endpoint
 description: Detect the usage of comsvcs.dll for dumping the lsass process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
+  Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.original_file_name
   Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: None identified.
 references:
 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
@@ -71,10 +68,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml
index 45aa504675..5413198060 100644
--- a/detections/endpoint/enable_rdp_in_other_port_number.yml
+++ b/detections/endpoint/enable_rdp_in_other_port_number.yml
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+  Sysmon TA. 
 known_false_positives: unknown
 references:
 - https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/
diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index 19935dd25e..87c51792c0 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -1,6 +1,6 @@
 name: Mshta spawning Rundll32 OR Regsvr32 Process
 id: 4aa5d062-e893-11eb-9eb2-acde48001122
-version: 1
+version: 2
 date: '2021-07-19'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -12,14 +12,11 @@ description: This search is to detect a suspicious mshta.exe process that spawn
   trickbot payload.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  = "mshta.exe"  (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe)
+  = "mshta.exe"  `process_rundll32` OR Processes.process_name=regsvr32.exe
   by Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: limitted. this anomaly behavior is not commonly seen in clean
   host.
 references:
@@ -56,10 +53,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - parent_process
-  - process_name
-  - process
-  - process_id
-  - process_guid
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml
index d213e2a550..3ce6a77165 100644
--- a/detections/endpoint/office_application_spawn_rundll32_process.yml
+++ b/detections/endpoint/office_application_spawn_rundll32_process.yml
@@ -1,6 +1,6 @@
 name: Office Application Spawn rundll32 process
 id: 958751e4-9c5f-11eb-b103-acde48001122
-version: 1
+version: 2
 date: '2021-04-13'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -13,14 +13,11 @@ description: this detection was designed to identifies suspicious spawned proces
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
-  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=rundll32.exe  by
+  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") `process_rundll32`  by
   Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `office_application_spawn_rundll32_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://any.run/malware-trends/trickbot
@@ -53,12 +50,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.process
-  - Processes.parent_process_name
-  - _time
-  - Processes.process_name
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
index 5c4fd58cc8..639f84fb3b 100644
--- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
+++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
@@ -1,6 +1,6 @@
 name: Office Product Spawning Rundll32 with no DLL
 id: c661f6be-a38c-11eb-be57-acde48001122
-version: 1
+version: 2
 date: '2021-04-22'
 author: Michael Haag, Splunk
 type: TTP
@@ -18,14 +18,12 @@ description: The following detection identifies the latest behavior utilized by
   additional parallel processes for further activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=rundll32.exe
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_rundll32`
   (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `office_product_spawning_rundll32_with_no_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
@@ -65,11 +63,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
index 158a21243f..df3454262d 100644
--- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
@@ -1,6 +1,6 @@
 name: Rundll32 with no Command Line Arguments with Network
 id: 35307032-a12d-11eb-835f-acde48001122
-version: 1
+version: 2
 date: '2021-04-19'
 author: Michael Haag, Splunk
 type: TTP
@@ -14,8 +14,8 @@ description: The following analytic identifies rundll32.exe with no command line
   dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and
   C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=rundll32.exe by _time span=1h  Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  where `process_rundll32` by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(rundll32\.exe.{0,4}$)" | join  process_id [| tstats `security_content_summariesonly`
   count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id
@@ -24,7 +24,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -66,12 +66,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest_port
-  - process_path
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 4623413561..c95ef9bc78 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -1,6 +1,6 @@
 name: RunDLL Loading DLL By Ordinal
 id: 6c135f8d-5e60-454e-80b7-c56eed739833
-version: 4
+version: 5
 date: '2020-11-30'
 author: David Dorsey, Splunk
 type: TTP
@@ -13,14 +13,10 @@ description: This search looks for executing scripts with rundll32. Adversaries
   operations.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = rundll32.exe by Processes.process_name Processes.parent_process_name
+  where `process_rundll32` by Processes.process_name Processes.parent_process_name Processes.original_file_name
   Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: While not common, loading a DLL under %AppData% and calling
   a function by ordinal is possible by a legitimate process
 references: []
@@ -62,10 +58,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml
index 207ba2a6de..61be215693 100644
--- a/detections/endpoint/spoolsv_spawning_rundll32.yml
+++ b/detections/endpoint/spoolsv_spawning_rundll32.yml
@@ -1,6 +1,6 @@
 name: Spoolsv Spawning Rundll32
 id: 15d905f6-da6b-11eb-ab82-acde48001122
-version: 1
+version: 2
 date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
 type: TTP
@@ -14,13 +14,11 @@ description: The following analytic identifies a suspicious child process, `rund
   additional file modification events.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe
-  Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process
+  `process_rundll32` by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `spoolsv_spawning_rundll32_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives have been identified. There are limited
   instances where `rundll32.exe` may be spawned by a legitimate print driver.
 references:
@@ -68,10 +66,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
index d879eec091..44cfdf79b1 100644
--- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
+++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
@@ -1,6 +1,6 @@
 name: Suspicious IcedID Rundll32 Cmdline
 id: bed761f8-ee29-11eb-8bf3-acde48001122
-version: 1
+version: 2
 date: '2021-07-26'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -10,15 +10,12 @@ description: This search is to detect a suspicious rundll32.exe commandline to e
   dll file. This technique was seen in IcedID malware to load its payload dll with
   the following parameter to load encrypted dll payload which is the license.dat.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
   Processes.process=*/i:* by  Processes.process_name Processes.process Processes.parent_process_name
   Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: limitted. this parameter is not commonly used by windows application
   but can be used by the network operator.
 references:
@@ -54,13 +51,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process
-  - parent_process_name
-  - parent_process
-  - process_id
-  - parent_process_id
-  - dest
-  - user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index 8d480afd61..0efa9f7510 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -1,6 +1,6 @@
 name: Suspicious Rundll32 dllregisterserver
 id: 8c00a385-9b86-4ac0-8932-c9ec3713b159
-version: 1
+version: 2
 date: '2021-02-09'
 author: Michael Haag, Splunk
 type: TTP
@@ -14,14 +14,12 @@ description: The following analytic identifies rundll32.exe using dllregisterser
   parrellel processes executing. Capture the DLL being loaded and inspect further.
   Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
+  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: This is likely to produce false positives and will require
   some filtering. Tune the query by adding command line paths to known good DLLs,
   or filtering based on parent process names.
@@ -72,12 +70,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml
index c27fcd66ad..764447cf42 100644
--- a/detections/endpoint/suspicious_rundll32_plugininit.yml
+++ b/detections/endpoint/suspicious_rundll32_plugininit.yml
@@ -1,6 +1,6 @@
 name: Suspicious Rundll32 PluginInit
 id: 92d51712-ee29-11eb-b1ae-acde48001122
-version: 1
+version: 2
 date: '2021-07-26'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -10,15 +10,12 @@ description: This search is to detect a suspicious rundll32.exe process with plu
   parameter. This technique is commonly seen in IceID malware to execute its initial
   dll stager to download another payload to the compromised machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
-  Processes.process=*PluginInit* by  Processes.process_name Processes.process Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
+  Processes.process=*PluginInit* by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
   Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: third party application may used this dll export name to execute
   function.
 references:
@@ -54,13 +51,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process
-  - parent_process_name
-  - parent_process
-  - process_id
-  - parent_process_id
-  - dest
-  - user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index 2f73eb8dad..15beb66012 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -1,6 +1,6 @@
 name: Suspicious Rundll32 Rename
 id: 7360137f-abad-473e-8189-acbdaa34d114
-version: 2
+version: 3
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
@@ -13,14 +13,11 @@ description: The following analytic identifies renamed instances of rundll32.exe
   internal name from the PE meta data. Expand the query as needed by looking for specific
   command line arguments outlined in other analytics.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=RUNDLL32.exe
-  AND Processes.process_name!=rundll32.exe) by Processes.dest Processes.user Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_rundll32_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -68,13 +65,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - OriginalFileName
-  - process_name
-  - Computer
-  - User
-  - parent_process_name
-  - process_path
-  - CommandLine
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index 4146d00b6a..950fc9799c 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -1,6 +1,6 @@
 name: Suspicious Rundll32 StartW
 id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
-version: 2
+version: 3
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
@@ -16,14 +16,11 @@ description: The following analytic identifies rundll32.exe executing a DLL func
   rundll32.exe is the default process it opens and injects shellcode into. This default
   process can be changed, but typically is not.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=RUNDLL32.exe
-  OR Processes.process_name=rundll32.exe) Processes.process=*start* by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*start* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_startw_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use Start
   as a function and call it via the command line. Filter as needed.
 references:
@@ -73,12 +70,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
diff --git a/macros/process_rundll32.yml b/macros/process_rundll32.yml
new file mode 100644
index 0000000000..701a94ccce
--- /dev/null
+++ b/macros/process_rundll32.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_rundll32
\ No newline at end of file

From ad88e9a0ffa86b1d0bbb46c5f6365717425e5766 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 13:27:48 -0600
Subject: [PATCH 039/153] macro'd regsvr32

---
 ...ct_regsvr32_application_control_bypass.yml | 20 +++++-------
 ..._spawning_rundll32_or_regsvr32_process.yml |  2 +-
 ...ice_application_spawn_regsvr32_process.yml | 28 ++++++++--------
 .../suspicious_icedid_regsvr32_cmdline.yml    | 32 +++++++++----------
 ...ious_regsvr32_register_suspicious_path.yml | 19 ++++++-----
 macros/process_regsvr32.yml                   |  3 ++
 6 files changed, 53 insertions(+), 51 deletions(-)
 create mode 100644 macros/process_regsvr32.yml

diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index bb3fa8c83d..f46fea0d60 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -1,6 +1,6 @@
 name: Detect Regsvr32 Application Control Bypass
 id: 070e9b80-6252-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-28'
 author: Michael Haag, Splunk
 type: TTP
@@ -17,15 +17,11 @@ description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious
   is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon
   execution. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe
-  OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*scrobj* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives related to third party software registering
   .DLL's.
 references:
@@ -83,11 +79,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index 87c51792c0..c129bcfcaf 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -12,7 +12,7 @@ description: This search is to detect a suspicious mshta.exe process that spawn
   trickbot payload.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  = "mshta.exe"  `process_rundll32` OR Processes.process_name=regsvr32.exe
+  = "mshta.exe"  `process_rundll32` OR `process_regsvr32`
   by Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml
index ab814876e8..13039b5f65 100644
--- a/detections/endpoint/office_application_spawn_regsvr32_process.yml
+++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml
@@ -1,6 +1,6 @@
 name: Office Application Spawn Regsvr32 process
 id: 2d9fc90c-f11f-11eb-9300-acde48001122
-version: 1
+version: 2
 date: '2021-07-30'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -13,15 +13,12 @@ description: this detection was designed to identifies suspicious spawned proces
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
-  = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") Processes.process_name=regsvr32.exe
-  by Processes.parent_process_name Processes.parent_process Processes.process_name
+  = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") `process_regsvr32`
+  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `office_application_spawn_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://www.joesandbox.com/analysis/380662/0/html
@@ -52,13 +49,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_guid
-  - Processes.user
   - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml
index 98b994cef9..47767c6ed9 100644
--- a/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml
+++ b/detections/endpoint/suspicious_icedid_regsvr32_cmdline.yml
@@ -1,8 +1,8 @@
 name: Suspicious IcedID Regsvr32 Cmdline
 id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
-version: 1
+version: 2
 date: '2021-07-27'
-author: Teoderick Contreras,
+author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -11,15 +11,12 @@ description: this search is to detect a suspicious regsvr32 commandline "-s" to
   dll that will download the 2nd stage loader that will download and decrypt the config
   payload.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe
-  Processes.process=*-s* by  Processes.process_name Processes.process Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32`
+  Processes.process=*-s* by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
   Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed regsvr32.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: minimal. but network operator can use this application to load
   dll.
 references:
@@ -55,13 +52,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process
-  - parent_process_name
-  - parent_process
-  - process_id
-  - parent_process_id
-  - dest
-  - user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 3452d3f752..1409c29f15 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -1,6 +1,6 @@
 name: Suspicious Regsvr32 Register Suspicious Path
 id: 62732736-6250-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-28'
 author: Michael Haag, Splunk
 type: TTP
@@ -11,17 +11,17 @@ description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious
   look for network connections to remote destinations (internal or external). Review
   additional parrallel processes and child processes for additional activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32`
   (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*)
   (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
   field in the Endpoint data model. Tune the query by filtering additional extensions
-  found to be used by  legitimate processes.
+  found to be used by  legitimate processes. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives with the query restricted to specified
   paths. Add more world writeable paths as tuning continues.
 references:
@@ -70,13 +70,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
diff --git a/macros/process_regsvr32.yml b/macros/process_regsvr32.yml
new file mode 100644
index 0000000000..da3b88c6f4
--- /dev/null
+++ b/macros/process_regsvr32.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_regsvr32
\ No newline at end of file

From a1a670203f8db9df36b5ff1534ad120738ba1868 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 13:38:11 -0600
Subject: [PATCH 040/153] macro'd mshta

---
 .../detect_mshta_inline_hta_execution.yml     | 10 +++----
 detections/endpoint/detect_mshta_renamed.yml  |  3 +--
 .../detect_mshta_url_in_command_line.yml      | 10 +++----
 .../office_product_spawning_mshta.yml         | 27 ++++++++++---------
 .../endpoint/suspicious_mshta_spawn.yml       | 23 +++++++++-------
 macros/process_mshta.yml                      |  3 +++
 6 files changed, 40 insertions(+), 36 deletions(-)
 create mode 100644 macros/process_mshta.yml

diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 03c3a48a91..3be6e65d8d 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -1,6 +1,6 @@
 name: Detect mshta inline hta execution
 id: a0873b32-5b68-11eb-ae93-0242ac130002
-version: 5
+version: 6
 date: '2021-01-20'
 author: Bhavin Patel, Michael Haag, Splunk
 type: TTP
@@ -13,14 +13,12 @@ description: The following analytic identifies "mshta.exe" execution with inline
   as well as the target system, the user, process "mshta.exe" and its parent process.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta`
   (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*)
-  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
+  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_mshta_inline_hta_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index 86de7b4a2d..702796d6ce 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -11,8 +11,7 @@ description: The following analytic identifies renamed instances of mshta.exe ex
   binary. Further analysis should be performed to review the executed content and
   validation it is the real mshta.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=mshta.exe
-  AND Processes.process_name!=mshta.exe) by Processes.dest Processes.user Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_mshta` by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 50149021bf..6cb9e3bc2f 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -1,6 +1,6 @@
 name: Detect MSHTA Url in Command Line
 id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-20'
 author: Michael Haag, Splunk
 type: TTP
@@ -15,13 +15,11 @@ description: This analytic identifies when Microsoft HTML Application Host (msht
   as well as the target system, the user, process "rundll32.exe" and its parent process.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta`
   (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user
-  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
+  Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest  | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: It is possible legitimate applications may perform this behavior
   and will need to be filtered.
 references:
diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml
index 40d267f9f7..b63bc18ba3 100644
--- a/detections/endpoint/office_product_spawning_mshta.yml
+++ b/detections/endpoint/office_product_spawning_mshta.yml
@@ -1,6 +1,6 @@
 name: Office Product Spawning MSHTA
 id: 6078fa20-a6d2-11eb-b662-acde48001122
-version: 1
+version: 2
 date: '2021-04-26'
 author: Michael Haag, Splunk
 type: TTP
@@ -18,13 +18,11 @@ description: The following detection identifies the latest behavior utilized by
   parallel processes for further activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=mshta.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_mshta`
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://redcanary.com/threat-detection-report/threats/TA551/
@@ -61,11 +59,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
index 972b572807..29bc90494e 100644
--- a/detections/endpoint/suspicious_mshta_spawn.yml
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -1,6 +1,6 @@
 name: Suspicious mshta spawn
 id: 4d33a488-5b5f-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-20'
 author: Michael Haag, Splunk
 type: TTP
@@ -13,12 +13,10 @@ description: The following analytic identifies wmiprvse.exe spawning mshta.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe
-  OR Processes.parent_process_name=wmiprvse.exe) AND Processes.process_name=mshta.exe
-  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  OR Processes.parent_process_name=wmiprvse.exe) AND `process_mshta`
+  by Processes.dest Processes.parent_process Processes.user Processes.original_file_name| `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
@@ -59,11 +57,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
   - Processes.dest
-  - Processes.parent_process
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/macros/process_mshta.yml b/macros/process_mshta.yml
new file mode 100644
index 0000000000..4abb688e72
--- /dev/null
+++ b/macros/process_mshta.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_mshta
\ No newline at end of file

From 5dc0e8f21198926c4e120f1b0387e080edb12af0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 13:56:57 -0600
Subject: [PATCH 041/153] macro'd net

---
 .../account_discovery_with_net_app.yml        | 24 ++++++++---------
 .../attempt_to_stop_security_service.yml      | 27 ++++++++-----------
 ...ate_local_admin_accounts_using_net_exe.yml | 21 ++++++---------
 ...or_delete_windows_shares_using_net_exe.yml | 11 +++-----
 detections/endpoint/deleting_of_net_users.yml | 11 +++-----
 .../endpoint/disabling_net_user_account.yml   | 23 ++++++++--------
 .../excessive_service_stop_attempt.yml        | 24 +++++++++--------
 .../endpoint/excessive_usage_of_net_app.yml   | 23 ++++++++--------
 macros/process_net.yml                        |  3 +++
 9 files changed, 78 insertions(+), 89 deletions(-)
 create mode 100644 macros/process_net.yml

diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index 7be21e49f5..b30787cb2b 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -1,6 +1,6 @@
 name: Account Discovery With Net App
 id: 339805ce-ac30-11eb-b87d-acde48001122
-version: 1
+version: 2
 date: '2021-05-03'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -16,15 +16,12 @@ description: this search is to detect a potential account discovery series of co
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
+  where `process_net` AND
   (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view
   /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
   | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product..
 known_false_positives: admin or power user may used this series of command.
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
@@ -66,13 +63,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process_id
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_guid
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 5
   security_domain: endpoint
diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml
index 9bd837791d..7685b114c8 100644
--- a/detections/endpoint/attempt_to_stop_security_service.yml
+++ b/detections/endpoint/attempt_to_stop_security_service.yml
@@ -1,6 +1,6 @@
 name: Attempt To Stop Security Service
 id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
-version: 3
+version: 4
 date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: TTP
@@ -10,22 +10,13 @@ description: This search looks for attempts to stop security-related services on
   endpoint.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name = net.exe OR  Processes.process_name = sc.exe) Processes.process="*
-  stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  where `process_net` OR  Processes.process_name = sc.exe Processes.process="*
+  stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup
   security_services_lookup service as process OUTPUTNEW category, description | search
   category=security | `attempt_to_stop_security_service_filter`'
-how_to_implement: You must be ingesting data that records the file-system activity
-  from your hosts to populate the Endpoint file-system data-model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data. The search is shipped with a lookup file, `security_services.csv`,
-  that can be edited to update the list of services to monitor. This lookup file can
-  be edited directly where it lives in `$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups`,
-  or via the Splunk console. You should add the names of services an attacker might
-  use on the command line and surround with asterisks (*****), so that they work properly
-  when searching the command line. The file should be updated with the names of any
-  services you would like to monitor for attempts to stop the service.,
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: None identified. Attempts to disable security-related services
   should be identified and understood.
 references:
@@ -83,10 +74,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 20
   security_domain: endpoint
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index a14fc89726..15e60fc8a9 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,6 +1,6 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 4
+version: 5
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: TTP
@@ -10,16 +10,11 @@ description: This search looks for the creation of local administrator accounts
   net.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
-  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add*
-  OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*localgroup* OR Processes.process=*/add*
+  OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   |`create_local_admin_accounts_using_net_exe_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators often leverage net.exe to create admin accounts.
 references: []
 tags:
@@ -73,11 +68,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index fd79a29901..9c35b10d69 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -1,6 +1,6 @@
 name: Create or delete windows shares using net exe
 id: qw9919ed-fe5f-492c-b139-151bb162140e
-version: 5
+version: 6
 date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: TTP
@@ -10,15 +10,10 @@ description: This search looks for the creation or deletion of hidden shares usi
   net.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe
-  OR Processes.process_name=net1.exe) by Processes.process Processes.process_name
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process Processes.process_name Processes.original_file_name
   Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators often leverage net.exe to create or delete network
   shares. You should verify that the activity was intentional and is legitimate.
 references:
diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml
index c97189d6df..f324a38485 100644
--- a/detections/endpoint/deleting_of_net_users.yml
+++ b/detections/endpoint/deleting_of_net_users.yml
@@ -1,6 +1,6 @@
 name: Deleting Of Net Users
 id: 1c8c6f66-acce-11eb-aafb-acde48001122
-version: 1
+version: 2
 date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -15,14 +15,11 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
-  Processes.process="*user*" AND  Processes.process="*/delete*" by  Processes.process_name
+  where `process_net` AND
+  Processes.process="*user*" AND  Processes.process="*/delete*" by  Processes.process_name Processes.original_file_name
   Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: System administrators or scripts may delete user accounts via
   this technique. Filter as needed.
 references:
diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml
index 8d6e919aa2..44a8ee146b 100644
--- a/detections/endpoint/disabling_net_user_account.yml
+++ b/detections/endpoint/disabling_net_user_account.yml
@@ -1,6 +1,6 @@
 name: Disabling Net User Account
 id: c0325326-acd6-11eb-98c2-acde48001122
-version: 1
+version: 2
 date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -13,15 +13,11 @@ description: This analytic will identify a suspicious command-line that disables
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
-  Processes.process="*user*" AND Processes.process="*/active:no*" by  Processes.process_name
+  where `process_net` AND
+  Processes.process="*user*" AND Processes.process="*/active:no*" by  Processes.process_name Processes.original_file_name
   Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
-  used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -65,11 +61,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
-  - Processes.parent_process
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml
index 465fd2d8e6..e4398ef01f 100644
--- a/detections/endpoint/excessive_service_stop_attempt.yml
+++ b/detections/endpoint/excessive_service_stop_attempt.yml
@@ -1,6 +1,6 @@
 name: Excessive Service Stop Attempt
 id: ae8d3f4a-acd7-11eb-8846-acde48001122
-version: 1
+version: 2
 date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: Anomaly
@@ -12,16 +12,13 @@ description: This analytic identifies suspicious series of attempt to kill multi
   there objective and evade detections.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "net.exe"
+  as lastTime  from datamodel=Endpoint.Processes where `process_net`
   OR  Processes.process_name = "sc.exe" OR  Processes.process_name = "net1.exe" AND
-  Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name
+  Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name
   Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
   count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -58,11 +55,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.parent_process_name
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml
index dd3b3c50a3..e246211019 100644
--- a/detections/endpoint/excessive_usage_of_net_app.yml
+++ b/detections/endpoint/excessive_usage_of_net_app.yml
@@ -1,6 +1,6 @@
 name: Excessive Usage Of Net App
 id: 45e52536-ae42-11eb-b5c6-acde48001122
-version: 1
+version: 2
 date: '2021-05-06'
 author: Teoderick Contreras, Splunk
 type: Anomaly
@@ -12,14 +12,10 @@ description: This analytic identifies excessive usage of `net.exe` or `net1.exe`
   malicious behavior.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "net.exe"
-  OR Processes.process_name = "net1.exe" by Processes.process_name Processes.parent_process_name
+  as lastTime  from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name
   Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown. Filter as needed. Modify the time span as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -62,11 +58,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.parent_process_name
   - Processes.dest
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 28
   security_domain: endpoint
diff --git a/macros/process_net.yml b/macros/process_net.yml
new file mode 100644
index 0000000000..ca8bb9efa5
--- /dev/null
+++ b/macros/process_net.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe")
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_net
\ No newline at end of file

From 9b71656519a9151e41929183c172ffcd9c43696c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 14:23:58 -0600
Subject: [PATCH 042/153] reg + fix

---
 .../endpoint/extract_sam_from_registry.yml     | 18 ++++++++++--------
 .../endpoint/nishang_powershelltcponeline.yml  |  1 -
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml
index fcce95ace9..d9001db991 100644
--- a/detections/endpoint/extract_sam_from_registry.yml
+++ b/detections/endpoint/extract_sam_from_registry.yml
@@ -1,6 +1,6 @@
 name: Extract SAM from Registry
 id: 8bbb7d58-b360-11eb-ba21-acde48001122
-version: 1
+version: 2
 date: '2021-05-12'
 author: Michael Haag, Splunk
 type: TTP
@@ -11,15 +11,13 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_reg`
   (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
   OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: It is possible some agent based products will generate false
   positives. Filter as needed.
 references:
@@ -66,10 +64,14 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index 6144c53355..f8bd1f3598 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -14,7 +14,6 @@ description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility
   process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
   (Processes.process=*Net.Sockets.TCPClient* AND Processes.process=*System.Text.ASCIIEncoding*)
   by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`

From e1752d3440abdeeb12ec94c7cc2cf7c78a7a3230 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 14:29:16 -0600
Subject: [PATCH 043/153] macro'd hh

---
 .../endpoint/detect_html_help_renamed.yml     | 19 +++++++------------
 .../detect_html_help_url_in_command_line.yml  | 18 ++++++++----------
 ...l_help_using_infotech_storage_handlers.yml | 16 +++++++---------
 macros/process_hh.yml                         |  3 +++
 4 files changed, 25 insertions(+), 31 deletions(-)
 create mode 100644 macros/process_hh.yml

diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 8245829d60..b2518140b1 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -1,6 +1,6 @@
 name: Detect HTML Help Renamed
 id: 62fed254-513b-460e-953d-79771493a9f3
-version: 2
+version: 3
 date: '2021-02-11'
 author: Michael Haag, Splunk
 type: TTP
@@ -18,16 +18,11 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
   it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=HH.exe
-  AND Processes.process_name!=hh.exe) by Processes.dest Processes.user Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used
   legitimately, filter as needed.
 references:
@@ -82,11 +77,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml
index be2bcb6580..0ffd1bbedd 100644
--- a/detections/endpoint/detect_html_help_url_in_command_line.yml
+++ b/detections/endpoint/detect_html_help_url_in_command_line.yml
@@ -1,6 +1,6 @@
 name: Detect HTML Help URL in Command Line
 id: 8c5835b9-39d9-438b-817c-95f14c69a31e
-version: 1
+version: 2
 date: '2021-02-11'
 author: Michael Haag, Splunk
 type: TTP
@@ -18,14 +18,12 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a
   IP and domain. Some instances, it is worth decompiling the .chm file to review its
   original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe
-  Processes.process=*http* by Processes.dest Processes.user Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where `process_hh`
+  Processes.process=*http* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_html_help_url_in_command_line_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may retrieve
   a CHM remotely, filter as needed.
 references:
@@ -84,11 +82,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
index 216df47a09..910229fdc0 100644
--- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
@@ -1,6 +1,6 @@
 name: Detect HTML Help Using InfoTech Storage Handlers
 id: 0b2eefa5-5508-450d-b970-3dd2fb761aec
-version: 1
+version: 2
 date: '2021-02-11'
 author: Michael Haag, Splunk
 type: TTP
@@ -20,14 +20,12 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a
   script content origination. hh.exe is natively found in C:\Windows\system32 and
   C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_hh`
   Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
   used, but it does happen in some legitimate instances. Filter as needed.
 references:
@@ -81,11 +79,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/macros/process_hh.yml b/macros/process_hh.yml
new file mode 100644
index 0000000000..83cdd10883
--- /dev/null
+++ b/macros/process_hh.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_hh
\ No newline at end of file

From ba6c98c292a5c89c8b798f3e60faa88d4151c3a4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 15:00:51 -0600
Subject: [PATCH 044/153] macro'd certutil

---
 ...load_with_urlcache_and_split_arguments.yml | 18 ++++++-------
 ...oad_with_verifyctl_and_split_arguments.yml | 18 ++++++-------
 .../certutil_exe_certificate_extraction.yml   | 16 +++++------
 .../certutil_with_decode_argument.yml         | 16 +++++------
 .../office_product_spawning_certutil.yml      | 27 ++++++++++---------
 macros/process_certutil.yml                   |  3 +++
 6 files changed, 48 insertions(+), 50 deletions(-)
 create mode 100644 macros/process_certutil.yml

diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 27323baaeb..9345297797 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -1,6 +1,6 @@
 name: CertUtil Download With URLCache and Split Arguments
 id: 415b4306-8bfb-11eb-85c4-acde48001122
-version: 1
+version: 2
 date: '2021-03-23'
 author: Michael Haag, Splunk
 type: TTP
@@ -14,14 +14,12 @@ description: Certutil.exe may download a file from a remote destination using `-
   During triage, capture any files on disk and review. Review the reputation of the
   remote IP or domain in question.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
   Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives in most environments, however tune
   as needed based on parent-child relationship or network connection.
 references:
@@ -71,11 +69,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index 2271ff23db..88a4c40b0f 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -1,6 +1,6 @@
 name: CertUtil Download With VerifyCtl and Split Arguments
 id: 801ad9e4-8bfb-11eb-8b31-acde48001122
-version: 1
+version: 2
 date: '2021-03-23'
 author: Michael Haag, Splunk
 type: TTP
@@ -14,14 +14,12 @@ description: 'Certutil.exe may download a file from a remote destination using `
   the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
-  Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
+  Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives in most environments, however tune
   as needed based on parent-child relationship or network connection.
 references:
@@ -72,11 +70,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index 4b025d252b..f75243f8da 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -1,6 +1,6 @@
 name: Certutil exe certificate extraction
 id: 337a46be-600f-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-26'
 author: Rod Soto, Splunk
 type: TTP
@@ -10,14 +10,12 @@ description: This search looks for arguments to certutil.exe indicating the mani
   or extraction of Certificate. This certificate can then be used to sign new authentication
   tokens specially inside Federated environments such as Windows ADFS.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
-  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
+  as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
   Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id|
   `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `certutil_exe_certificate_extraction_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Unless there are specific use cases, manipulating or exporting
   certificates using certutil is uncommon. Extraction of certificate has been observed
   during attacks such as Golden SAML and other campaigns targeting Federated services.
@@ -64,11 +62,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml
index e4e9a826da..b05b500f31 100644
--- a/detections/endpoint/certutil_with_decode_argument.yml
+++ b/detections/endpoint/certutil_with_decode_argument.yml
@@ -1,6 +1,6 @@
 name: CertUtil With Decode Argument
 id: bfe94226-8c10-11eb-a4b3-acde48001122
-version: 1
+version: 2
 date: '2021-03-23'
 author: Michael Haag, Splunk
 type: TTP
@@ -15,14 +15,12 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including
   further execution. During triage, identify the source of the file being decoded.
   Review its contents or execution behavior for further analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
   Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `certutil_with_decode_argument_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Typically seen used to `encode` files, but it is possible to
   see legitimate use of `decode`. Filter based on parent-child relationship, file
   paths, endpoint or user.
@@ -73,11 +71,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml
index 7e6d4e2fd3..ade292c00e 100644
--- a/detections/endpoint/office_product_spawning_certutil.yml
+++ b/detections/endpoint/office_product_spawning_certutil.yml
@@ -1,6 +1,6 @@
 name: Office Product Spawning CertUtil
 id: 6925fe72-a6d5-11eb-9e17-acde48001122
-version: 1
+version: 2
 date: '2021-04-26'
 author: Michael Haag, Splunk
 type: TTP
@@ -18,13 +18,11 @@ description: The following detection identifies the latest behavior utilized by
   for further activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=certutil.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_certutil`
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_certutil_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://redcanary.com/threat-detection-report/threats/TA551/
@@ -61,11 +59,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/macros/process_certutil.yml b/macros/process_certutil.yml
new file mode 100644
index 0000000000..d3b247fc73
--- /dev/null
+++ b/macros/process_certutil.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_certutil
\ No newline at end of file

From 71481634a31e8e505b79c2af0a03416e37c57d69 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 15:14:35 -0600
Subject: [PATCH 045/153] macro'd netsh

---
 ..._file_and_printing_sharing_in_firewall.yml | 22 +++++++++----------
 .../allow_network_discovery_in_firewall.yml   | 22 +++++++++----------
 .../disabling_firewall_with_netsh.yml         | 22 +++++++++----------
 macros/process_netsh.yml                      |  3 +++
 4 files changed, 36 insertions(+), 33 deletions(-)
 create mode 100644 macros/process_netsh.yml

diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
index 2612ea28d4..18c3ec13ee 100644
--- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
@@ -1,6 +1,6 @@
 name: Allow File And Printing Sharing In Firewall
 id: ce27646e-d411-11eb-8a00-acde48001122
-version: 1
+version: 2
 date: '2021-06-23'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -10,16 +10,13 @@ description: This search is to detect a suspicious modification of firewall to a
   file and printer sharing. This technique was seen in ransomware to be able to discover
   more machine connected to the compromised host to encrypt more files
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_netsh`
   Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*"  Processes.process="*enable=Yes*"
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `allow_file_and_printing_sharing_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
@@ -43,10 +40,13 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
-  - Processes.parent_process_name
   security_domain: endpoint
diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml
index 2c23347daf..410cadec08 100644
--- a/detections/endpoint/allow_network_discovery_in_firewall.yml
+++ b/detections/endpoint/allow_network_discovery_in_firewall.yml
@@ -1,6 +1,6 @@
 name: Allow Network Discovery In Firewall
 id: ccd6a38c-d40b-11eb-85a5-acde48001122
-version: 1
+version: 2
 date: '2021-06-23'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -11,16 +11,13 @@ description: This search is to detect a suspicious modification to the firewall
   (revil, reddot) to discover other machine connected to the compromised host to encrypt
   more files.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_netsh`
   Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*"  Processes.process="*enable*"
-  Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
@@ -45,10 +42,13 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.process_name
-  - Processes.process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
-  - Processes.parent_process
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
-  - Processes.parent_process_name
   security_domain: endpoint
diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index abe9f89292..f7a665b6f5 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -1,6 +1,6 @@
 name: Disabling Firewall with Netsh
 id: 6860a62c-9203-11eb-9e05-acde48001122
-version: 1
+version: 2
 date: '2021-03-31'
 author: Teoderick Contreras, Splunk
 type: TTP
@@ -10,15 +10,12 @@ description: This search is to identifies suspicious firewall disabling using ne
   application. this technique is commonly seen in malware that tries to communicate
   or download its component or other payload to its C2 server.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_netsh`
   Processes.process= "*firewall*" (Processes.process= "*off*" OR  Processes.process=
-  "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`'
-how_to_implement: You must be ingesting data that records the filesystem activity
-  from your hosts to populate the Endpoint file-system data model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: admin may disable firewall during testing or fixing network
   problem.
 references:
@@ -56,13 +53,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
   - Processes.dest
   - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
   - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/macros/process_netsh.yml b/macros/process_netsh.yml
new file mode 100644
index 0000000000..f2541ba479
--- /dev/null
+++ b/macros/process_netsh.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_netsh
\ No newline at end of file

From d648d525b3a0e56556c7094e8754aee25d125bcc Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 17 Aug 2021 15:20:40 -0600
Subject: [PATCH 046/153] macro'd bitsadmin

---
 detections/endpoint/bits_job_persistence.yml  | 18 ++++++-------
 .../endpoint/bitsadmin_download_file.yml      | 18 ++++++-------
 .../office_product_spawning_bitsadmin.yml     | 27 ++++++++++---------
 macros/process_bitsadmin.yml                  |  3 +++
 4 files changed, 34 insertions(+), 32 deletions(-)
 create mode 100644 macros/process_bitsadmin.yml

diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml
index 1ff46bb365..2c0a86fe86 100644
--- a/detections/endpoint/bits_job_persistence.yml
+++ b/detections/endpoint/bits_job_persistence.yml
@@ -1,6 +1,6 @@
 name: BITS Job Persistence
 id: e97a5ffe-90bf-11eb-928a-acde48001122
-version: 1
+version: 2
 date: '2021-03-29'
 author: Michael Haag, Splunk
 type: TTP
@@ -14,15 +14,13 @@ description: The following query identifies Microsoft Background Intelligent Tra
   to be used to upload files and this may require further network data analysis to
   identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin`
   Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*,
-  *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user
+  *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives will be present. Typically, applications
   will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
   (legitimate applications) or parent process.
@@ -73,11 +71,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index e917d2ccef..e30e5fcd0d 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -1,6 +1,6 @@
 name: BITSAdmin Download File
 id: 80630ff4-8e4c-11eb-aab5-acde48001122
-version: 1
+version: 2
 date: '2021-03-26'
 author: Michael Haag, Splunk
 type: TTP
@@ -19,14 +19,12 @@ description: The following query identifies Microsoft Background Intelligent Tra
   malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
   to list out the jobs during investigation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe
-  Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin`
+  Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `bitsadmin_download_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives, however it may be required to filter
   based on parent process name or network connection.
 references:
@@ -79,11 +77,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml
index de38297d4b..d3469cb4b6 100644
--- a/detections/endpoint/office_product_spawning_bitsadmin.yml
+++ b/detections/endpoint/office_product_spawning_bitsadmin.yml
@@ -1,6 +1,6 @@
 name: Office Product Spawning BITSAdmin
 id: e8c591f4-a6d7-11eb-8cf7-acde48001122
-version: 1
+version: 2
 date: '2021-04-26'
 author: Michael Haag, Splunk
 type: TTP
@@ -19,13 +19,11 @@ description: The following detection identifies the latest behavior utilized by
   for further activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=bitsadmin.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_bitsadmin`
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
@@ -61,11 +59,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
-  - dest
-  - user
-  - parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/macros/process_bitsadmin.yml b/macros/process_bitsadmin.yml
new file mode 100644
index 0000000000..690c215bcb
--- /dev/null
+++ b/macros/process_bitsadmin.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_bitsadmin
\ No newline at end of file

From 09f29ad08129bd1dd0919bb7061f2e09549a8c50 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 18 Aug 2021 09:50:08 -0600
Subject: [PATCH 047/153] macros

---
 macros/process_dllhost.yml                   | 3 +++
 macros/process_dsquery.yml                   | 3 +++
 macros/process_fodhelper.yml                 | 3 +++
 macros/process_gpupdate.yml                  | 3 +++
 macros/process_microsoftworkflowcompiler.yml | 3 +++
 macros/process_nltest.yml                    | 3 +++
 macros/process_ntdsutil.yml                  | 3 +++
 macros/process_regasm.yml                    | 3 +++
 macros/process_regsvcs.yml                   | 3 +++
 macros/process_schtasks.yml                  | 3 +++
 macros/process_vssadmin.yml                  | 3 +++
 macros/process_wbadmin.yml                   | 3 +++
 12 files changed, 36 insertions(+)
 create mode 100644 macros/process_dllhost.yml
 create mode 100644 macros/process_dsquery.yml
 create mode 100644 macros/process_fodhelper.yml
 create mode 100644 macros/process_gpupdate.yml
 create mode 100644 macros/process_microsoftworkflowcompiler.yml
 create mode 100644 macros/process_nltest.yml
 create mode 100644 macros/process_ntdsutil.yml
 create mode 100644 macros/process_regasm.yml
 create mode 100644 macros/process_regsvcs.yml
 create mode 100644 macros/process_schtasks.yml
 create mode 100644 macros/process_vssadmin.yml
 create mode 100644 macros/process_wbadmin.yml

diff --git a/macros/process_dllhost.yml b/macros/process_dllhost.yml
new file mode 100644
index 0000000000..7ec461cd16
--- /dev/null
+++ b/macros/process_dllhost.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_dllhost
diff --git a/macros/process_dsquery.yml b/macros/process_dsquery.yml
new file mode 100644
index 0000000000..2704093847
--- /dev/null
+++ b/macros/process_dsquery.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=dsquery.exe OR Processes.original_file_name=dsquery.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_dsquery
diff --git a/macros/process_fodhelper.yml b/macros/process_fodhelper.yml
new file mode 100644
index 0000000000..d8a90face8
--- /dev/null
+++ b/macros/process_fodhelper.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=fodhelper.exe OR Processes.original_file_name=FodHelper.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_fodhelper
diff --git a/macros/process_gpupdate.yml b/macros/process_gpupdate.yml
new file mode 100644
index 0000000000..0ae1adc415
--- /dev/null
+++ b/macros/process_gpupdate.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_gpupdate
diff --git a/macros/process_microsoftworkflowcompiler.yml b/macros/process_microsoftworkflowcompiler.yml
new file mode 100644
index 0000000000..1650207295
--- /dev/null
+++ b/macros/process_microsoftworkflowcompiler.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_microsoftworkflowcompiler
diff --git a/macros/process_nltest.yml b/macros/process_nltest.yml
new file mode 100644
index 0000000000..5791864168
--- /dev/null
+++ b/macros/process_nltest.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=nltest.exe OR Processes.original_file_name=nltestrk.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_nltest
diff --git a/macros/process_ntdsutil.yml b/macros/process_ntdsutil.yml
new file mode 100644
index 0000000000..896aa5ed82
--- /dev/null
+++ b/macros/process_ntdsutil.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=ntdsutil.exe OR Processes.original_file_name=ntdsutil.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_ntdsutil
diff --git a/macros/process_regasm.yml b/macros/process_regasm.yml
new file mode 100644
index 0000000000..b84016e325
--- /dev/null
+++ b/macros/process_regasm.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_regasm
\ No newline at end of file
diff --git a/macros/process_regsvcs.yml b/macros/process_regsvcs.yml
new file mode 100644
index 0000000000..f36778807b
--- /dev/null
+++ b/macros/process_regsvcs.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_regsvcs
diff --git a/macros/process_schtasks.yml b/macros/process_schtasks.yml
new file mode 100644
index 0000000000..0cf22df0b7
--- /dev/null
+++ b/macros/process_schtasks.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_schtasks
diff --git a/macros/process_vssadmin.yml b/macros/process_vssadmin.yml
new file mode 100644
index 0000000000..3778fd8f79
--- /dev/null
+++ b/macros/process_vssadmin.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_vssadmin
diff --git a/macros/process_wbadmin.yml b/macros/process_wbadmin.yml
new file mode 100644
index 0000000000..8e79d9c498
--- /dev/null
+++ b/macros/process_wbadmin.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_wbadmin

From 0e19432a1dcd02461a7a250e7a2655e5169daa2f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 19 Aug 2021 06:57:11 -0600
Subject: [PATCH 048/153] msbuild and microsoftworkflowcompiler

---
 ...ous_microsoft_workflow_compiler_rename.yml | 29 +++++++++----------
 ...ious_microsoft_workflow_compiler_usage.yml | 15 ++++------
 .../endpoint/suspicious_msbuild_path.yml      | 23 ++++++++-------
 .../endpoint/suspicious_msbuild_rename.yml    |  2 +-
 .../endpoint/suspicious_msbuild_spawn.yml     | 21 ++++++++------
 macros/process_msbuild.yml                    |  3 ++
 6 files changed, 49 insertions(+), 44 deletions(-)
 create mode 100644 macros/process_msbuild.yml

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index 2db8c36e6a..cc3bcf8312 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -1,6 +1,6 @@
 name: Suspicious microsoft workflow compiler rename
 id: f0db4464-55d9-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
@@ -13,15 +13,11 @@ description: The following analytic identifies a renamed instance of microsoft.w
   In any instance, microsoft.workflow.compiler.exe spawning from an Office product
   or any living off the land binary is highly suspect.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe
-  AND Processes.process_name!=microsoft.workflow.compiler.exe) by Processes.dest Processes.user
+  as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler` by Processes.dest Processes.user
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_rename_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of microsoft.workflow.compiler.exe, triggering a false positive.
 references:
@@ -70,13 +66,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - OriginalFileName
-  - process_name
-  - Computer
-  - User
-  - parent_process_name
-  - process_path
-  - CommandLine
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 736f34fa21..287aca6205 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -11,14 +11,11 @@ description: The following analytic identifies microsoft.workflow.compiler.exe u
   and is rarely utilized. When investigating, identify the executed code on disk and
   review. It is not a commonly used process by many applications.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=microsoft.workflow.compiler.exe
-  OR Processes.process_name=microsoft.workflow.compiler.exe) by Processes.dest Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler` by Processes.dest Processes.parent_process
   Processes.process_name Processes.original_file_name Processes.process Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_microsoft_workflow_compiler_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, limited instances have been identified coming
   from native Microsoft utilities similar to SCCM.
 references:
@@ -63,11 +60,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index ba4df4363d..b348902fea 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -1,6 +1,6 @@
 name: Suspicious msbuild path
 id: f5198224-551c-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
@@ -13,13 +13,11 @@ description: The following analytic identifies msbuild.exe executing from a non-
   there are instances of build applications that will move or use a copy of MSBuild.
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
-  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*) by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where `process_msbuild`
+  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*) by Processes.dest Processes.original_file_name
   Processes.parent_process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe,
   triggering a false positive. Baselining of MSBuild.exe usage is recommended to better
   understand it's path usage. Visual Studio runs an instance out of a path that will
@@ -69,11 +67,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_path
   - Processes.dest
-  - Processes.parent_process
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index fae7f5bd24..a8c0ba564b 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -11,7 +11,7 @@ description: The following analytic identifies renamed instances of msbuild.exe
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=MSBuild.exe AND Processes.process_name!=msbuild.exe)
+  as lastTime from datamodel=Endpoint.Processes where `process_msbuild`
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
   | `drop_dm_object_name(Processes)` 
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index fce318fe25..30630eaa5c 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -1,6 +1,6 @@
 name: Suspicious MSBuild Spawn
 id: a115fba6-5514-11eb-ae93-0242ac130002
-version: 1
+version: 2
 date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
@@ -16,12 +16,10 @@ description: The following analytic identifies wmiprvse.exe spawning msbuild.exe
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
-  AND Processes.process_name=msbuild.exe by Processes.dest Processes.parent_process
+  AND `process_msbuild` by Processes.dest Processes.parent_process Processes.original_file_name
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
@@ -65,11 +63,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
   - Processes.dest
-  - Processes.parent_process
   - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/macros/process_msbuild.yml b/macros/process_msbuild.yml
new file mode 100644
index 0000000000..0662995513
--- /dev/null
+++ b/macros/process_msbuild.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_msbuild

From ed4be191187d5c0d7dc2b6dc79ddda4115e27a00 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-205-251>
Date: Fri, 3 Sep 2021 16:05:32 +0000
Subject: [PATCH 049/153] Added detection testing service results inCertutil
 exe certificate extraction


From 217d7fd23e8fc2b2848ec85dd4d505e6af1e6ea4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 09:42:56 -0600
Subject: [PATCH 050/153] updates

---
 detections/endpoint/account_discovery_with_net_app.yml    | 8 +++-----
 .../attempt_to_add_certificate_to_untrusted_store.yml     | 6 +++---
 detections/endpoint/detect_html_help_renamed.yml          | 6 +++---
 detections/endpoint/detect_mshta_renamed.yml              | 7 ++++---
 detections/endpoint/suspicious_rundll32_rename.yml        | 2 +-
 5 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index 30f31c74e6..14fd59c9f9 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -1,7 +1,7 @@
 name: Account Discovery With Net App
 id: 339805ce-ac30-11eb-b87d-acde48001122
-version: 2
-date: '2021-05-03'
+version: 3
+date: '2021-09-16'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -16,9 +16,7 @@ description: this search is to detect a potential account discovery series of co
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_net` AND
-  (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view
-  /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
+  where `process_net` AND (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
   | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product..
diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
index 64404c913f..87a828d8d3 100644
--- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
@@ -1,14 +1,14 @@
 name: Attempt To Add Certificate To Untrusted Store
 id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
-version: 6
-date: '2020-11-03'
+version: 7
+date: '2021-09-16'
 author: Patrick Bareiss, Rico Valdez, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: Attempt To Add Certificate To Untrusted Store
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
-  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil*
+  as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
   (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index b2518140b1..44a56d7d33 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -1,11 +1,11 @@
 name: Detect HTML Help Renamed
 id: 62fed254-513b-460e-953d-79771493a9f3
 version: 3
-date: '2021-02-11'
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
-- Endpoint
+  - Endpoint
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index 702796d6ce..92207bcc67 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -1,10 +1,11 @@
 name: Detect mshta renamed
 id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
 version: 2
-date: '2021-01-20'
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
-datamodel: []
+type: Hunting
+datamodel:
+  - Endpoint
 description: The following analytic identifies renamed instances of mshta.exe executing.
   Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
   analytic utilizes the internal name of the PE to identify if is the legitimate mshta
diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index 15beb66012..c61f510865 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -3,7 +3,7 @@ id: 7360137f-abad-473e-8189-acbdaa34d114
 version: 3
 date: '2021-02-04'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel: 
 - Endpoint
 description: The following analytic identifies renamed instances of rundll32.exe executing.

From 46c20ccb77d190001d48593ecfd30cb331344de6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 09:47:25 -0600
Subject: [PATCH 051/153] Update
 attempted_credential_dump_from_registry_via_reg_exe.yml

---
 .../attempted_credential_dump_from_registry_via_reg_exe.yml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index 1b09691d37..c9f22159ca 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -1,7 +1,7 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-version: 5
-date: '2019-12-02'
+version: 6
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:

From 9111b9a0a58ba72331a619d54e6b096629284582 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 09:58:07 -0600
Subject: [PATCH 052/153] Update batch_file_write_to_system32.yml

---
 .../endpoint/batch_file_write_to_system32.yml | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index 6ca36e6087..327b38cb90 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -1,19 +1,23 @@
 name: Batch File Write to System32
 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
-version: 1
-date: '2018-12-14'
+version: 2
+date: '2021-09-16'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: The search looks for a batch file (.bat) written to the Windows system
   directory tree.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name
-  values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path
-  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|
-  rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_path=*system32*
-  AND file_extension=.bat | `batch_file_write_to_system32_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=*  by _time span=1h Processes.process_id Processes.process_name
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*",
+  "*\\syswow64\\*") Filesystem.file_name="*.bat"
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
+  file_name file_path process_name process_path process] | dedup file_create_time
+  | table dest file_create_time, file_name, file_path, process_name  | `batch_file_write_to_system32_filter`'
 how_to_implement: You must be ingesting data that records the file-system activity
   from your hosts to populate the Endpoint file-system data-model node. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which

From f68371cc3f4f4e3718bf04efe8cc0762470ae349 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-143-41>
Date: Thu, 16 Sep 2021 16:02:23 +0000
Subject: [PATCH 053/153] Added detection testing service results inAccount
 Discovery With Net App

---
 .../account_discovery_with_net_app.yml        | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index 14fd59c9f9..ca323b4f37 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -16,10 +16,15 @@ description: this search is to detect a potential account discovery series of co
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_net` AND (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
-  | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product..
+  where `process_net` AND (Processes.process="*user*" OR  Processes.process="*config*"
+  OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user
+  Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product..
 known_false_positives: admin or power user may used this series of command.
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
@@ -63,11 +68,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 48f5786538a0f362d2ab87331a281452a3ce1563 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-122-248>
Date: Thu, 16 Sep 2021 16:03:33 +0000
Subject: [PATCH 054/153] Added detection testing service results inAttempt To
 Add Certificate To Untrusted Store


From abc6aa1eb7ffcdcd71a6c0e35dfd4dbd961eef7b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-136-181>
Date: Thu, 16 Sep 2021 16:07:36 +0000
Subject: [PATCH 055/153] Added detection testing service results inAttempted
 Credential Dump From Registry via Reg exe

---
 ...dential_dump_from_registry_via_reg_exe.yml | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index c9f22159ca..bedad02553 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -9,13 +9,18 @@ datamodel:
 description: Monitor for execution of reg.exe with parameters specifying an export
   of keys that contain hashed credentials that attackers may try to crack offline.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
-  OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
-  OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd`
+  Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM*
+  OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security*
+  OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: None identified.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
@@ -69,11 +74,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 2e2f4546df5362e2297144f0067ec296dbaddedc Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-13-46>
Date: Thu, 16 Sep 2021 16:18:21 +0000
Subject: [PATCH 056/153] Added detection testing service results inBatch File
 Write to System32

---
 detections/endpoint/batch_file_write_to_system32.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index 327b38cb90..d40ff09989 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -13,11 +13,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
   tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*",
-  "*\\syswow64\\*") Filesystem.file_name="*.bat"
-  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
-  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
-  file_name file_path process_name process_path process] | dedup file_create_time
-  | table dest file_create_time, file_name, file_path, process_name  | `batch_file_write_to_system32_filter`'
+  "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest
+  Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
+  | fields _time dest file_create_time file_name file_path process_name process_path
+  process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
+  process_name  | `batch_file_write_to_system32_filter`'
 how_to_implement: You must be ingesting data that records the file-system activity
   from your hosts to populate the Endpoint file-system data-model node. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which

From 3844ad4bcbfb8343dcfedf1f4170f57838566d3a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:22:24 -0600
Subject: [PATCH 057/153] Update batch_file_write_to_system32.yml

---
 detections/endpoint/batch_file_write_to_system32.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index d40ff09989..e01c2c7f80 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -2,7 +2,7 @@ name: Batch File Write to System32
 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
 version: 2
 date: '2021-09-16'
-author: Rico Valdez, Splunk
+author: Michael Haag, Rico Valdez, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -18,10 +18,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   | fields _time dest file_create_time file_name file_path process_name process_path
   process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
   process_name  | `batch_file_write_to_system32_filter`'
-how_to_implement: You must be ingesting data that records the file-system activity
-  from your hosts to populate the Endpoint file-system data-model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: It is possible for this search to generate a notable event
   for a batch file write to a path that includes the string "system32", but is not
   the actual Windows system directory. As such, you should confirm the path of the
@@ -76,5 +73,8 @@ tags:
   - Filesystem.file_name
   - Filesystem.user
   - Filesystem.file_path
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.dest
   risk_score: 63
   security_domain: endpoint

From e8ddb9aadcb9edc88c416fe62dddfb229190f81f Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:23:11 -0600
Subject: [PATCH 058/153] Update bits_job_persistence.yml

---
 detections/endpoint/bits_job_persistence.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml
index 2c0a86fe86..0568b0c451 100644
--- a/detections/endpoint/bits_job_persistence.yml
+++ b/detections/endpoint/bits_job_persistence.yml
@@ -1,7 +1,7 @@
 name: BITS Job Persistence
 id: e97a5ffe-90bf-11eb-928a-acde48001122
 version: 2
-date: '2021-03-29'
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:

From 4171a3cd63ba58b86aaad6307a39710000f7dff3 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:23:55 -0600
Subject: [PATCH 059/153] Update bitsadmin_download_file.yml

---
 detections/endpoint/bitsadmin_download_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index e30e5fcd0d..5e67542f33 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -1,7 +1,7 @@
 name: BITSAdmin Download File
 id: 80630ff4-8e4c-11eb-aab5-acde48001122
 version: 2
-date: '2021-03-26'
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:

From 53806fe5f0f996c913cf4184ca39a2ecd817bec4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:28:52 -0600
Subject: [PATCH 060/153] Update office_product_spawning_wmic.yml

---
 detections/endpoint/office_product_spawning_wmic.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml
index 586a4399fb..620dd8cd38 100644
--- a/detections/endpoint/office_product_spawning_wmic.yml
+++ b/detections/endpoint/office_product_spawning_wmic.yml
@@ -1,7 +1,7 @@
 name: Office Product Spawning Wmic
 id: ffc236d6-a6c9-11eb-95f1-acde48001122
-version: 2
-date: '2021-04-26'
+version: 3
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - FIN7
   automated_detection_testing: passed
   confidence: 90
   context:

From c5cdccf1b46a20d5d70f8fea9f3cfdfe187c29aa Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:32:08 -0600
Subject: [PATCH 061/153] Update create_local_admin_accounts_using_net_exe.yml

---
 .../endpoint/create_local_admin_accounts_using_net_exe.yml     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 44d1cf8a46..0a81974971 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -10,8 +10,7 @@ description: This search looks for the creation of local administrator accounts
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
-  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   |`create_local_admin_accounts_using_net_exe_filter` '
 how_to_implement: You must be ingesting data that records process activity from your

From 5fe3b8ad85fdd505b3c6b1bce8d9a7d4ff8485a8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:33:18 -0600
Subject: [PATCH 062/153] fixes

---
 .../endpoint/create_local_admin_accounts_using_net_exe.yml      | 2 +-
 .../endpoint/create_or_delete_windows_shares_using_net_exe.yml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 0a81974971..31d142a537 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,7 +1,7 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
 version: 5
-date: '2021-08-29'
+date: '2021-09-16'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index 9c35b10d69..8268138e58 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -1,7 +1,7 @@
 name: Create or delete windows shares using net exe
 id: qw9919ed-fe5f-492c-b139-151bb162140e
 version: 6
-date: '2020-07-21'
+date: '2020-09-16'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:

From f43bffd899dc8e3e725d6d456ce706253bdcc91a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:37:34 -0600
Subject: [PATCH 063/153] Update
 creation_of_shadow_copy_with_wmic_and_powershell.yml

---
 .../creation_of_shadow_copy_with_wmic_and_powershell.yml      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index 299dd423fd..74c9311b06 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -1,7 +1,7 @@
 name: Creation of Shadow Copy with wmic and powershell
 id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
-version: 2
-date: '2019-12-10'
+version: 3
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:

From 6059b4e1353612fb9f35e434ab70474d784e5137 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-229-45>
Date: Thu, 16 Sep 2021 16:41:29 +0000
Subject: [PATCH 064/153] Added detection testing service results inBITS Job
 Persistence

---
 detections/endpoint/bits_job_persistence.yml | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml
index 0568b0c451..44262d9858 100644
--- a/detections/endpoint/bits_job_persistence.yml
+++ b/detections/endpoint/bits_job_persistence.yml
@@ -14,13 +14,17 @@ description: The following query identifies Microsoft Background Intelligent Tra
   to be used to upload files and this may require further network data analysis to
   identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin`
-  Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*,
-  *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
+  IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*,
+  *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives will be present. Typically, applications
   will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
   (legitimate applications) or parent process.
@@ -71,11 +75,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From ddae4670bbf0b8e96035075c70f0de81ccaa7676 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-197-111>
Date: Thu, 16 Sep 2021 16:45:19 +0000
Subject: [PATCH 065/153] Added detection testing service results inBITSAdmin
 Download File

---
 .../endpoint/bitsadmin_download_file.yml       | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index 5e67542f33..241dae1127 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -19,12 +19,16 @@ description: The following query identifies Microsoft Background Intelligent Tra
   malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
   to list out the jobs during investigation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin`
-  Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process=*transfer*
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `bitsadmin_download_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives, however it may be required to filter
   based on parent process name or network connection.
 references:
@@ -77,11 +81,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 261bdc42708d2974a1969a350731cb407a324b82 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:50:21 -0600
Subject: [PATCH 066/153] Update
 credential_dumping_via_copy_command_from_shadow_copy.yml

---
 .../credential_dumping_via_copy_command_from_shadow_copy.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index ffdf93a927..9d69a568ee 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -1,7 +1,7 @@
 name: Credential Dumping via Copy Command from Shadow Copy
 id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
 version: 2
-date: '2019-12-10'
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:

From 7acb54087f0e2d876cdc0d0c5fcbdc1797297636 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-180-23>
Date: Thu, 16 Sep 2021 16:51:07 +0000
Subject: [PATCH 067/153] Added detection testing service results inCreate
 local admin accounts using net exe

---
 .../endpoint/create_local_admin_accounts_using_net_exe.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 31d142a537..f4fd68f261 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -10,9 +10,10 @@ description: This search looks for the creation of local administrator accounts
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  |`create_local_admin_accounts_using_net_exe_filter` '
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND
+  (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add*
+  by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_accounts_using_net_exe_filter` '
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.

From 9e32a32bdd90c2a2ff44254bd8d22a5e324b8cf0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 10:52:50 -0600
Subject: [PATCH 068/153] Update
 credential_dumping_via_symlink_to_shadow_copy.yml

---
 ...dential_dumping_via_symlink_to_shadow_copy.yml | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
index e7c7638b40..714c0353a6 100644
--- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
@@ -1,22 +1,19 @@
 name: Credential Dumping via Symlink to Shadow Copy
 id: c5eac648-fae0-4263-91a6-773df1f4c903
-version: 1
-date: '2019-12-10'
+version: 2
+date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This search detects the creation of a symlink to a shadow copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
   Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest
-  Processes.user Processes.process_name Processes.process  Processes.parent_process
+  Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf

From 13a917ea62813a0e34863550d73469246fdb432c Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-239-53>
Date: Thu, 16 Sep 2021 16:52:59 +0000
Subject: [PATCH 069/153] Added detection testing service results inCreate or
 delete windows shares using net exe

---
 ...reate_or_delete_windows_shares_using_net_exe.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index 8268138e58..0ceb58467d 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -10,10 +10,15 @@ description: This search looks for the creation or deletion of hidden shares usi
   net.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process Processes.process_name Processes.original_file_name
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by
+  Processes.process Processes.process_name Processes.original_file_name Processes.dest
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Administrators often leverage net.exe to create or delete network
   shares. You should verify that the activity was intentional and is legitimate.
 references:

From 8fc4ca5e903acf1daeaf9bb83b2b615648cea936 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-229-45>
Date: Thu, 16 Sep 2021 16:57:25 +0000
Subject: [PATCH 070/153] Added detection testing service results inCreation of
 Shadow Copy with wmic and powershell

---
 ...ation_of_shadow_copy_with_wmic_and_powershell.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index 74c9311b06..aa1e8a3c66 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -9,11 +9,15 @@ datamodel:
 description: This search detects the use of wmic and Powershell to create a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_wmic`
-  OR `process_powershell` Processes.process=*shadowcopy* Processes.process=*create*
-  by Processes.user Processes.process_name Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell`
+  Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name
+  Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf

From 6c467dbb80f3d0d5f262c7fb3f18df1bdec9926b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-180-23>
Date: Thu, 16 Sep 2021 17:07:21 +0000
Subject: [PATCH 071/153] Added detection testing service results inCredential
 Dumping via Copy Command from Shadow Copy

---
 ...l_dumping_via_copy_command_from_shadow_copy.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index 9d69a568ee..936ac84c34 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -9,13 +9,17 @@ datamodel:
 description: This search detects credential dumping using copy command from a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
-  (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security*
-  OR Processes.process=*\\system32\\config\\system* OR Processes.process=*\\windows\\ntds\\ntds.dit*)
-  by Processes.dest Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd` (Processes.process=*\\system32\\config\\sam*
+  OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system*
+  OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.dest Processes.user
+  Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf

From eeb3af0c168ba152105f4a40763beb0435b7cb1b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-239-53>
Date: Thu, 16 Sep 2021 17:08:15 +0000
Subject: [PATCH 072/153] Added detection testing service results inCredential
 Dumping via Symlink to Shadow Copy

---
 ...ential_dumping_via_symlink_to_shadow_copy.yml | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
index 714c0353a6..58e83ed423 100644
--- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
@@ -8,12 +8,16 @@ datamodel:
 - Endpoint
 description: This search detects the creation of a symlink to a shadow copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
-  Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest
-  Processes.user Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink*
+  Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name
+  Processes.process  Processes.parent_process Processes.original_file_name Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf

From 695bd7236c7c31d35b926bfb16cb319cf1910e69 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 11:13:15 -0600
Subject: [PATCH 073/153] hh, mshta, and psexec

---
 .../detect_html_help_url_in_command_line.yml         |  2 +-
 ...ect_html_help_using_infotech_storage_handlers.yml |  2 +-
 .../endpoint/detect_mshta_inline_hta_execution.yml   |  2 +-
 .../endpoint/detect_mshta_url_in_command_line.yml    |  2 +-
 .../endpoint/detect_psexec_with_accepteula_flag.yml  | 12 ++++--------
 macros/process_psexec.yml                            |  3 +++
 6 files changed, 11 insertions(+), 12 deletions(-)
 create mode 100644 macros/process_psexec.yml

diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml
index 0ffd1bbedd..03bf5e73dc 100644
--- a/detections/endpoint/detect_html_help_url_in_command_line.yml
+++ b/detections/endpoint/detect_html_help_url_in_command_line.yml
@@ -1,7 +1,7 @@
 name: Detect HTML Help URL in Command Line
 id: 8c5835b9-39d9-438b-817c-95f14c69a31e
 version: 2
-date: '2021-02-11'
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
index 910229fdc0..6123e049b1 100644
--- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
@@ -1,7 +1,7 @@
 name: Detect HTML Help Using InfoTech Storage Handlers
 id: 0b2eefa5-5508-450d-b970-3dd2fb761aec
 version: 2
-date: '2021-02-11'
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 3be6e65d8d..498dfeca73 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -1,7 +1,7 @@
 name: Detect mshta inline hta execution
 id: a0873b32-5b68-11eb-ae93-0242ac130002
 version: 6
-date: '2021-01-20'
+date: '2021-09-16'
 author: Bhavin Patel, Michael Haag, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 6cb9e3bc2f..f8855cd131 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -1,7 +1,7 @@
 name: Detect MSHTA Url in Command Line
 id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
 version: 2
-date: '2021-01-20'
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 2e8a201086..0c4142bc28 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -1,7 +1,7 @@
 name: Detect PsExec With accepteula Flag
 id: b89919ed-fe5f-492c-b139-151xb162040e
-version: 3
-date: '2020-11-10'
+version: 4
+date: '2021-09-16'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
@@ -16,15 +16,11 @@ description: This search looks for events where `PsExec.exe` is run with the `ac
   within the command line.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest
+  where `process_psexec` Processes.process=*accepteula* by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`|
   `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators can leverage PsExec for accessing remote systems
   and might pass `accepteula` as an argument if they are running this tool for the
   first time. However, it is not likely that you'd see multiple occurrences of this
diff --git a/macros/process_psexec.yml b/macros/process_psexec.yml
new file mode 100644
index 0000000000..f0fe20a9f6
--- /dev/null
+++ b/macros/process_psexec.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_psexec
\ No newline at end of file

From 70fb8aaf7820f89be8853d0b1f6d9e91bd03f38a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 11:36:51 -0600
Subject: [PATCH 074/153] fixes

---
 detections/endpoint/detect_renamed_7_zip.yml             | 6 +++---
 detections/endpoint/detect_renamed_psexec.yml            | 9 ++++-----
 detections/endpoint/detect_renamed_rclone.yml            | 6 +++---
 detections/endpoint/detect_renamed_winrar.yml            | 6 +++---
 .../endpoint/domain_account_discovery_with_net_app.yml   | 3 +--
 5 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index b187b02d95..0a522bdafb 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -1,9 +1,9 @@
 name: Detect Renamed 7-Zip
 id: 4057291a-b8cf-11eb-95fe-acde48001122
-version: 1
-date: '2021-05-19'
+version: 2
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 324ebdd03f..033f2842a0 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -1,9 +1,9 @@
 name: Detect Renamed PSExec
 id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 2
-date: '2021-05-19'
+version: 3
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic identifies renamed instances of `PsExec.exe` being
@@ -12,8 +12,7 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   During triage, validate this is the legitimate version of `PsExec` by reviewing
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=psexec.c
-  (Processes.process_name!=psexec.exe OR Processes.process_name!=PsExec64.exe) by
+  as lastTime from datamodel=Endpoint.Processes where `process_psexec` by
   Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml
index bbd3f6a4ef..2bdc5b7bb6 100644
--- a/detections/endpoint/detect_renamed_rclone.yml
+++ b/detections/endpoint/detect_renamed_rclone.yml
@@ -1,9 +1,9 @@
 name: Detect Renamed RClone
 id: 6dca1124-b3ec-11eb-9328-acde48001122
-version: 1
-date: '2021-05-13'
+version: 2
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel: []
 description: The following analytic identifies the usage of `rclone.exe`, renamed,
   being used to exfiltrate data to a remote destination. RClone has been used by multiple
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 3b672f1597..d8e9ec6d8a 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -1,9 +1,9 @@
 name: Detect Renamed WinRAR
 id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
-version: 2
-date: '2021-05-19'
+version: 3
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analtyic identifies renamed instances of `WinRAR.exe`.
diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml
index 957e770258..8454154d22 100644
--- a/detections/endpoint/domain_account_discovery_with_net_app.yml
+++ b/detections/endpoint/domain_account_discovery_with_net_app.yml
@@ -11,8 +11,7 @@ description: This search is to detect a process command line for AD discovery. T
   the targetted machine. This techique was seen in several malware as part of there
   recon and can be a good pivot of analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
-  OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process
+  as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "* user*" AND Processes.process
   = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

From 04e8fd24b2e41073df2ec1c7c7db87ece3d8be71 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-252-172>
Date: Thu, 16 Sep 2021 17:56:37 +0000
Subject: [PATCH 075/153] Added detection testing service results inDomain
 Account Discovery With Net App

---
 .../endpoint/domain_account_discovery_with_net_app.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml
index 8454154d22..bcc418af61 100644
--- a/detections/endpoint/domain_account_discovery_with_net_app.yml
+++ b/detections/endpoint/domain_account_discovery_with_net_app.yml
@@ -11,11 +11,11 @@ description: This search is to detect a process command line for AD discovery. T
   the targetted machine. This techique was seen in several malware as part of there
   recon and can be a good pivot of analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "* user*" AND Processes.process
-  = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `domain_account_discovery_with_net_app_filter`'
+  as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process
+  = "* user*" AND Processes.process = "*/do*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

From bd6a779b024881e49175f9b1a872011cd6bb0f99 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 12:06:20 -0600
Subject: [PATCH 076/153] no longer need sysmon procdump - updated superior
 procdump

---
 .../endpoint/dump_lsass_via_procdump.yml      | 13 ++-
 .../dump_lsass_via_procdump_rename.yml        | 81 -------------------
 macros/process_procdump.yml                   |  3 +
 3 files changed, 8 insertions(+), 89 deletions(-)
 delete mode 100644 detections/endpoint/dump_lsass_via_procdump_rename.yml
 create mode 100644 macros/process_procdump.yml

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 3cfc940325..ba27a7007d 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -1,7 +1,7 @@
 name: Dump LSASS via procdump
 id: 3742ebfe-64c2-11eb-ae93-0242ac130002
-version: 1
-date: '2021-02-01'
+version: 2
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -17,14 +17,11 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   the command line. Review other endpoint data sources for cross process (injection)
   into lsass.exe.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
-  OR Processes.process_name=procdump64.exe (Processes.process=*-ma* OR Processes.process=*-mm*)
-  Processes.process=*lsass* by Processes.user Processes.process_name Processes.process
+  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*)
+  Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name
   Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: None identified.
 references:
 - https://attack.mitre.org/techniques/T1003/001/
diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml
deleted file mode 100644
index 0887b53a48..0000000000
--- a/detections/endpoint/dump_lsass_via_procdump_rename.yml
+++ /dev/null
@@ -1,81 +0,0 @@
-name: Dump LSASS via procdump Rename
-id: 21276daa-663d-11eb-ae93-0242ac130002
-version: 1
-date: '2021-02-01'
-author: Michael Haag, Splunk
-type: TTP
-datamodel: []
-description: 'Detect a renamed instance of procdump.exe dumping the lsass process.
-  This query looks for both -mm and -ma usage. -mm will produce a mini dump file and
-  -ma will write a dump file with all process memory. Both are highly suspect and
-  should be reviewed. Modify the query as needed.\
-
-  During triage, confirm this is procdump.exe executing. If it is the first time a
-  Sysinternals utility has been ran, it is possible there will be a -accepteula on
-  the command line. Review other endpoint data sources for cross process (injection)
-  into lsass.exe.'
-search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1
-  (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as
-  dest |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
-  process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: None identified.
-references:
-- https://attack.mitre.org/techniques/T1003/001/
-- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
-tags:
-  analytic_story:
-  - Credential Dumping
-  - HAFNIUM Group
-  asset_type: Endpoint
-  automated_detection_testing: passed
-  cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16
-  confidence: 100
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
-  impact: 80
-  kill_chain_phases:
-  - Actions on Objectives
-  message: The following $process_name$ has been identified as renamed, spawning from
-    $parent_process_name$ on $dest$, attempting to dump lsass.exe.
-  mitre_attack_id:
-  - T1003.001
-  nist:
-  - DE.CM
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Parent Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - OriginalFileName
-  - process_name
-  - EventID
-  - CommandLine
-  - Computer
-  - parent_process_name
-  risk_score: 80
-  security_domain: endpoint
diff --git a/macros/process_procdump.yml b/macros/process_procdump.yml
new file mode 100644
index 0000000000..16e72b4b41
--- /dev/null
+++ b/macros/process_procdump.yml
@@ -0,0 +1,3 @@
+definition: (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_procdump
\ No newline at end of file

From 9c08c1f2f42878fc87574bba30e86d2774a8fbd9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 12:14:26 -0600
Subject: [PATCH 077/153] fixes

---
 .../dump_lsass_via_procdump_rename.yml        | 81 +++++++++++++++++++
 .../local_account_discovery_with_net.yml      |  6 +-
 .../local_account_discovery_with_wmic.yml     |  6 +-
 3 files changed, 87 insertions(+), 6 deletions(-)
 create mode 100644 detections/deprecated/dump_lsass_via_procdump_rename.yml

diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml
new file mode 100644
index 0000000000..2b1e26203e
--- /dev/null
+++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml
@@ -0,0 +1,81 @@
+name: Dump LSASS via procdump Rename
+id: 21276daa-663d-11eb-ae93-0242ac130002
+version: 1
+date: '2021-02-01'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'Detect a renamed instance of procdump.exe dumping the lsass process.
+  This query looks for both -mm and -ma usage. -mm will produce a mini dump file and
+  -ma will write a dump file with all process memory. Both are highly suspect and
+  should be reviewed. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1
+  (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as
+  dest |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
+  process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: The following $process_name$ has been identified as renamed, spawning from
+    $parent_process_name$ on $dest$, attempting to dump lsass.exe.
+  mitre_attack_id:
+  - T1003.001
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OriginalFileName
+  - process_name
+  - EventID
+  - CommandLine
+  - Computer
+  - parent_process_name
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
index 505ad8b723..f1723a4acf 100644
--- a/detections/endpoint/local_account_discovery_with_net.yml
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -1,7 +1,7 @@
 name: Local Account Discovery with Net
 id: 5d0d4830-0133-11ec-bae3-acde48001122
-version: 1
-date: '2021-08-19'
+version: 2
+date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic looks for the execution of `net.exe` or `net1.exe` wi
   arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. 
   Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") 
+  as lastTime from datamodel=Endpoint.Processes where `process_net`
   (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`'
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
index 58ad212ff3..9f8983958d 100644
--- a/detections/endpoint/local_account_discovery_with_wmic.yml
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -1,7 +1,7 @@
 name: Local Account Discovery With Wmic
 id: 4902d7aa-0134-11ec-9d65-acde48001122
-version: 1
-date: '2021-08-19'
+version: 2
+date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic looks for the execution of `wmic.exe` with command-li
   arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. 
   Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) 
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) 
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`'

From 6f9c536f8e870db76793fbe836043fe480423771 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 12:15:53 -0600
Subject: [PATCH 078/153] error

---
 tests/endpoint/dump_lsass_via_procdump_rename.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml
index fd04f46735..b1225d12fd 100644
--- a/tests/endpoint/dump_lsass_via_procdump_rename.test.yml
+++ b/tests/endpoint/dump_lsass_via_procdump_rename.test.yml
@@ -1,7 +1,7 @@
 name: Dump lsass via procdump rename Unit Test
 tests:
 - name: Dump lsass via procdump rename
-  file: endpoint/dump_lsass_via_procdump_rename.yml
+  file: deprecated/dump_lsass_via_procdump_rename.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 4178c03b52d358465588696ba3c02f224ee6c603 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-127-3>
Date: Thu, 16 Sep 2021 18:19:16 +0000
Subject: [PATCH 079/153] Added detection testing service results inDetect
 PsExec With accepteula Flag

---
 .../detect_psexec_with_accepteula_flag.yml         | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 0c4142bc28..690fa3d715 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -16,11 +16,15 @@ description: This search looks for events where `PsExec.exe` is run with the `ac
   within the command line.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_psexec` Processes.process=*accepteula* by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`|
-  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  where `process_psexec` Processes.process=*accepteula* by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Administrators can leverage PsExec for accessing remote systems
   and might pass `accepteula` as an argument if they are running this tool for the
   first time. However, it is not likely that you'd see multiple occurrences of this

From fbc3185dbc2ba97c48cba95a4e629d58d74a049a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 16 Sep 2021 12:24:53 -0600
Subject: [PATCH 080/153] Update processes_launching_netsh.yml

---
 detections/endpoint/processes_launching_netsh.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
index 7252e476ad..6cd75754bf 100644
--- a/detections/endpoint/processes_launching_netsh.yml
+++ b/detections/endpoint/processes_launching_netsh.yml
@@ -1,8 +1,8 @@
 name: Processes launching netsh
 id: b89919ed-fe5f-492c-b139-95dbb162040e
-version: 3
-date: '2020-07-10'
-author: Josef Kuepker, Splunk
+version: 4
+date: '2021-09-16'
+author: Michael Haag, Josef Kuepker, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -14,11 +14,10 @@ description: This search looks for processes launching netsh.exe. Netsh is a com
   executing commands via the command line.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process=*netsh* by Processes.parent_process_name Processes.parent_process
+  where `process_netsh` by Processes.parent_process_name Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.user Processes.dest |`drop_dm_object_name("Processes")`
   |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
   of these instances, it is unusual for an executable to launch netsh.exe and run
   commands.

From 20565487024acc78a91b4655b482b7d89a1abafd Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-93-190>
Date: Thu, 16 Sep 2021 18:25:52 +0000
Subject: [PATCH 081/153] Added detection testing service results inDump LSASS
 via procdump

---
 detections/endpoint/dump_lsass_via_procdump.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index ba27a7007d..4c97cba1aa 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -17,11 +17,15 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   the command line. Review other endpoint data sources for cross process (injection)
   into lsass.exe.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*)
-  Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma*
+  OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name
+  Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: None identified.
 references:
 - https://attack.mitre.org/techniques/T1003/001/

From e85e81804b8d35fc99b12cb23b605bac0d790aab Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-142-16>
Date: Thu, 16 Sep 2021 18:28:50 +0000
Subject: [PATCH 082/153] Added detection testing service results inExtract SAM
 from Registry

---
 .../endpoint/extract_sam_from_registry.yml    | 26 +++++++++++--------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml
index d9001db991..0cbe1f6fa5 100644
--- a/detections/endpoint/extract_sam_from_registry.yml
+++ b/detections/endpoint/extract_sam_from_registry.yml
@@ -11,13 +11,17 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_reg`
-  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
-  OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save*
+  OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system*
+  OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `extract_sam_from_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: It is possible some agent based products will generate false
   positives. Filter as needed.
 references:
@@ -64,11 +68,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 9156fe65e70de44e66953b8756762c6cf7a7d995 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-156-183>
Date: Thu, 16 Sep 2021 18:36:02 +0000
Subject: [PATCH 083/153] Added detection testing service results inExtract SAM
 from Registry

---
 .../endpoint/extract_sam_from_registry.yml    | 26 +++++++++++--------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml
index d9001db991..0cbe1f6fa5 100644
--- a/detections/endpoint/extract_sam_from_registry.yml
+++ b/detections/endpoint/extract_sam_from_registry.yml
@@ -11,13 +11,17 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_reg`
-  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
-  OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save*
+  OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system*
+  OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `extract_sam_from_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: It is possible some agent based products will generate false
   positives. Filter as needed.
 references:
@@ -64,11 +68,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 5b301ca9b63ca5b843833fb4667f66fc36dd6e87 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-93-190>
Date: Thu, 16 Sep 2021 18:42:10 +0000
Subject: [PATCH 084/153] Added detection testing service results inProcesses
 created by netsh

---
 detections/endpoint/processes_launching_netsh.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
index 6cd75754bf..9d38fe10ac 100644
--- a/detections/endpoint/processes_launching_netsh.yml
+++ b/detections/endpoint/processes_launching_netsh.yml
@@ -14,10 +14,15 @@ description: This search looks for processes launching netsh.exe. Netsh is a com
   executing commands via the command line.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_netsh` by Processes.parent_process_name Processes.parent_process Processes.original_file_name
-  Processes.process_name Processes.user Processes.dest |`drop_dm_object_name("Processes")`
-  |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  where `process_netsh` by Processes.parent_process_name Processes.parent_process
+  Processes.original_file_name Processes.process_name Processes.user Processes.dest
+  |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
+  |`processes_launching_netsh_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
   of these instances, it is unusual for an executable to launch netsh.exe and run
   commands.

From 6747a3051596ccf82877c5c7ee8e7f49394ada01 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 17 Sep 2021 05:46:53 -0600
Subject: [PATCH 085/153] Update create_local_admin_accounts_using_net_exe.yml

---
 .../create_local_admin_accounts_using_net_exe.yml  | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index f4fd68f261..bc8549a348 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,7 +1,7 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 5
-date: '2021-09-16'
+version: 6
+date: '2021-09-08'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
@@ -10,10 +10,12 @@ description: This search looks for the creation of local administrator accounts
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND
-  (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add*
+  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
+  OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators*
+  OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR
+  Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*)
   by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_accounts_using_net_exe_filter` '
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -82,4 +84,4 @@ tags:
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 30
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file

From d646da8e7019992f9f9345cd06dfe6de790e834e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 17 Sep 2021 05:48:51 -0600
Subject: [PATCH 086/153] Revert "Merge branch 'The-Haag-of-The-Storm' of
 https://github.com/splunk/security_content into The-Haag-of-The-Storm"

This reverts commit f7befe61e66a8a53477c425f17944f31c82c3291, reversing
changes made to 5b301ca9b63ca5b843833fb4667f66fc36dd6e87.
---
 .../endpoint/extract_sam_from_registry.yml    | 26 ++++++++-----------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml
index 0cbe1f6fa5..d9001db991 100644
--- a/detections/endpoint/extract_sam_from_registry.yml
+++ b/detections/endpoint/extract_sam_from_registry.yml
@@ -11,17 +11,13 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save*
-  OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system*
-  OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `extract_sam_from_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_reg`
+  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
+  OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: It is possible some agent based products will generate false
   positives. Filter as needed.
 references:
@@ -68,11 +64,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
   - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 3e996076c7374bd29e39aad93537962b2424de52 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 17 Sep 2021 05:56:19 -0600
Subject: [PATCH 087/153] updates

---
 detections/endpoint/extraction_of_registry_hives.yml     | 2 +-
 detections/endpoint/local_account_discovery_with_net.yml | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index e3b78557bd..6ed6dead78 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -11,7 +11,7 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
+  as lastTime from datamodel=Endpoint.Processes where `process_reg`
   (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam
   *" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
index 47b2644b4f..c940fc9ca9 100644
--- a/detections/endpoint/local_account_discovery_with_net.yml
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -11,8 +11,7 @@ description: This analytic looks for the execution of `net.exe` or `net1.exe` wi
   and 'users', return a list of all local users. Red Teams and adversaries alike use
   net.exe to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
-  OR Processes.process_name="net1.exe") (Processes.process=*user OR Processes.process=*users)
+  as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user OR Processes.process=*users)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`'

From 88a4494b694d3c54d71aecd6da9ae96da8a26253 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-97-195>
Date: Fri, 17 Sep 2021 12:32:04 +0000
Subject: [PATCH 088/153] Added detection testing service results inExtraction
 of Registry Hives

---
 .../endpoint/extraction_of_registry_hives.yml | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index 6ed6dead78..bec548212b 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -11,12 +11,12 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_reg`
-  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam
-  *" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'
+  as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save*
+  OR Processes.process=*export*) AND (Processes.process="*\sam *" OR Processes.process="*\system
+  *" OR Processes.process="*\security *") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `extraction_of_registry_hives_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -66,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 958e195593a27f3f4384e1349ce54f7fceba2463 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 10:05:07 -0600
Subject: [PATCH 089/153] Update
 searchprotocolhost_with_no_command_line_with_network.yml

---
 ...hprotocolhost_with_no_command_line_with_network.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index 06d912fc42..0b7f461771 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -14,14 +14,14 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   related to credential dumping or file writes. searchprotocolhost.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_guid
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_id [| tstats
+  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_guid [| tstats
   `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
-  !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
+  !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
   | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
-  process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
+  process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.

From 81183b661cae39139b972cddd12c937efbb0f32b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 10:37:57 -0600
Subject: [PATCH 090/153] Update
 detect_regasm_with_no_command_line_arguments.yml

---
 ..._regasm_with_no_command_line_arguments.yml | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index de011b5c55..c6755327ff 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -1,7 +1,7 @@
 name: Detect Regasm with no Command Line Arguments
 id: c3bc1430-04e7-4178-835f-047d8e6e97df
-version: 1
-date: '2021-02-12'
+version: 2
+date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -11,15 +11,12 @@ description: The following analytic identifies regasm.exe with no command line a
   connections and parallel processes. Identify any suspicious module loads related
   to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=1 (process_name=regasm.exe OR OriginalFileName=RegAsm.exe)
-  | regex CommandLine="(regasm\.exe.{0,4}$)" | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
-  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_regasm_with_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_regasm` by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, limited instances of regasm.exe or may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.

From 2bf10d4a33c40c6d3a53ab81c7676a90779b43ea Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-12-54>
Date: Mon, 20 Sep 2021 16:58:10 +0000
Subject: [PATCH 091/153] Added detection testing service results inDetect
 Regasm with no Command Line Arguments

---
 .../detect_regasm_with_no_command_line_arguments.yml   | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index c6755327ff..0133d06b82 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -12,11 +12,15 @@ description: The following analytic identifies regasm.exe with no command line a
   to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_regasm` by _time span=1h  Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  where `process_regasm` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely, limited instances of regasm.exe or may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.

From e07d94f396f78bba3ffc71b293d54ec1768e0c5b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 11:02:20 -0600
Subject: [PATCH 092/153] regsvcs regasm

---
 ..._regasm_with_no_command_line_arguments.yml | 28 ++++++-----
 ...regsvcs_with_no_command_line_arguments.yml | 48 +++++++++----------
 2 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index 0133d06b82..bda2e46549 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -4,7 +4,8 @@ version: 2
 date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies regasm.exe with no command line arguments.
   This particular behavior occurs when another process injects into regasm.exe, no
   command line arguments will be present. During investigation, identify any network
@@ -44,7 +45,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line
+  message: The process $process_name$ was spawned by $parent_process_name$ without any command-line
     arguments on $dest$ by $user$.
   mitre_attack_id:
   - T1218.009
@@ -60,7 +61,7 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: parent_image
+  - name: parent_process_name
     type: Parent Process
     role:
     - Parent Process
@@ -74,15 +75,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - process_path
-  - Computer
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
index 7ed5093a7d..745154a106 100644
--- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
@@ -1,25 +1,23 @@
 name: Detect Regsvcs with No Command Line Arguments
 id: 6b74d578-a02e-4e94-a0d1-39440d0bf254
-version: 1
-date: '2021-02-12'
+version: 2
+date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies regsvcs.exe with no command line arguments.
   This particular behavior occurs when another process injects into regsvcs.exe, no
   command line arguments will be present. During investigation, identify any network
   connections and parallel processes. Identify any suspicious module loads related
   to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=1 (process_name=regsvcs.exe OR OriginalFileName=RegSvcs.exe)
-  | regex CommandLine="(regsvcs\.exe.{0,4}$)" | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
-  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_regsvcs_with_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_regsvcs` by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.
@@ -43,7 +41,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line
+  message: The process $process_name$ was spawned by $parent_process_name$ without any command-line
     arguments on $dest$ by $user$.
   mitre_attack_id:
   - T1218.009
@@ -59,7 +57,7 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: parent_image
+  - name: parent_process_name
     type: Parent Process
     role:
     - Parent Process
@@ -73,16 +71,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - OriginalFileName
-  - process_path
-  - Computer
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint

From 5d2d0384e3712861df28db54dc1170daa730b87d Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-232-28>
Date: Mon, 20 Sep 2021 17:21:26 +0000
Subject: [PATCH 093/153] Added detection testing service results inDetect
 regsvcs with no Command Line Arguments

---
 ...regsvcs_with_no_command_line_arguments.yml | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
index 745154a106..d1a5d0ccd3 100644
--- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies regsvcs.exe with no command line arguments.
   This particular behavior occurs when another process injects into regsvcs.exe, no
   command line arguments will be present. During investigation, identify any network
@@ -13,11 +13,15 @@ description: The following analytic identifies regsvcs.exe with no command line
   to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_regsvcs` by _time span=1h  Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  where `process_regsvcs` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.
@@ -41,8 +45,8 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: The process $process_name$ was spawned by $parent_process_name$ without any command-line
-    arguments on $dest$ by $user$.
+  message: The process $process_name$ was spawned by $parent_process_name$ without
+    any command-line arguments on $dest$ by $user$.
   mitre_attack_id:
   - T1218.009
   nist:
@@ -73,11 +77,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 4320d4ab5be330e7300469cbe6128a77e7636417 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 11:32:31 -0600
Subject: [PATCH 094/153] Update
 suspicious_dllhost_no_command_line_arguments.yml

---
 ...ious_dllhost_no_command_line_arguments.yml | 39 +++++++++----------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index ec47894b9a..508559d5fe 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -1,7 +1,7 @@
 name: Suspicious DLLHost no Command Line Arguments
 id: ff61e98c-0337-4593-a78f-72a676c56f26
-version: 1
-date: '2021-02-23'
+version: 2
+date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -11,15 +11,12 @@ description: The following analytic identifies DLLHost.exe with no command line
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. DLLHost.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '`sysmon` EventID=1 (process_name=dllhost.exe OR OriginalFileName=dllhost.exe)
-  | regex CommandLine="(dllhost\.exe.{0,4}$)" | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
-  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_dllhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_dllhost` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
@@ -59,14 +56,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - process_path
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint

From 4096b496a5bd01a1ec41c8fe1494862c94597dd8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 11:34:25 -0600
Subject: [PATCH 095/153] Update
 suspicious_gpupdate_no_command_line_arguments.yml

---
 ...ous_gpupdate_no_command_line_arguments.yml | 37 ++++++++++---------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index 22f4e94fa3..da67668899 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -1,21 +1,22 @@
 name: Suspicious GPUpdate no Command Line Arguments
 id: f308490a-473a-40ef-ae64-dd7a6eba284a
-version: 1
-date: '2021-02-23'
+version: 2
+date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies gpupdate.exe with no command line arguments.
   It is unusual for gpupdate.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. gpupdate.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '`sysmon` EventID=1 (process_name=gpupdate.exe OR OriginalFileName=GPUpdate.exe)
-  | regex CommandLine="(gpupdate\.exe.{0,4}$)" | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
-  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_gpupdate_no_command_line_arguments_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_gpupdate` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(gpupdate\.exe.{0,4}$)"  | `suspicious_gpupdate_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -59,14 +60,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - process_path
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint

From 14f9bea86568d0e5ea635481f3bae40b2bec09b2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 11:39:40 -0600
Subject: [PATCH 096/153] mwc hunting and rundll32 fix

---
 ...ous_microsoft_workflow_compiler_rename.yml |  6 +--
 ...undll32_with_no_command_line_arguments.yml | 42 +++++++++----------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index cc3bcf8312..0127c45b1a 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -1,9 +1,9 @@
 name: Suspicious microsoft workflow compiler rename
 id: f0db4464-55d9-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
+version: 3
+date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index 4b0ed41df7..d657c6c6f8 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -1,25 +1,23 @@
 name: Suspicious Rundll32 no Command Line Arguments
 id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
-version: 1
-date: '2021-02-09'
+version: 2
+date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies rundll32.exe with no command line arguments.
   It is unusual for rundll32.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. Rundll32.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE)
-  | regex CommandLine="(rundll32\.exe.{0,4}$)" | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
-  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_rundll32` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -69,14 +67,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - process_path
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint

From 0718d28f83883b4f3ece08c0511db4b130276e10 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 11:42:34 -0600
Subject: [PATCH 097/153] Update
 suspicious_searchprotocolhost_no_command_line_arguments.yml

---
 ...protocolhost_no_command_line_arguments.yml | 42 +++++++++----------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index ad218ee556..2e52e91435 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -1,10 +1,11 @@
 name: Suspicious SearchProtocolHost no Command Line Arguments
 id: f52d2db8-31f9-4aa7-a176-25779effe55c
-version: 1
-date: '2021-02-23'
+version: 2
+date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments. It is unusual for searchprotocolhost.exe to execute with no command
   line arguments present. This particular behavior is common with malicious software,
@@ -12,15 +13,12 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   and parallel processes. Identify any suspicious module loads related to credential
   dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32
   and C:\Windows\syswow64.
-search: '`sysmon` EventID=1 (process_name=searchprotocolhost.exe OR OriginalFileName=SearchProtocolHost.exe)
-  | regex CommandLine="(searchprotocolhost\.exe.{0,4}$)" | stats count min(_time)
-  as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine,
-  process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(searchprotocolhost\.exe.{0,4}$)"  | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
@@ -59,14 +57,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventID
-  - process_name
-  - OriginalFileName
-  - CommandLine
-  - dest
-  - User
-  - ParentImage
-  - ParentCommandLine
-  - process_path
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint

From 0a34def1b356d6b172af3e51d13bac06d3fe47b3 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-50-184>
Date: Mon, 20 Sep 2021 17:51:28 +0000
Subject: [PATCH 098/153] Added detection testing service results inSuspicious
 DLLHost no Command Line Arguments

---
 ...uspicious_dllhost_no_command_line_arguments.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index 508559d5fe..da953aeba8 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -16,7 +16,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
@@ -58,11 +62,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 9373763ea308312415f6883a7fbdf781277f6f47 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-146-191>
Date: Mon, 20 Sep 2021 17:54:58 +0000
Subject: [PATCH 099/153] Added detection testing service results inSuspicious
 GPUpdate no Command Line Arguments

---
 .../suspicious_gpupdate_no_command_line_arguments.yml  | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index da67668899..b52fb89260 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies gpupdate.exe with no command line arguments.
   It is unusual for gpupdate.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
@@ -62,11 +62,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 28f03fcbcd1a03997256a44d7e503dae8e8e9597 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-231-218>
Date: Mon, 20 Sep 2021 17:58:12 +0000
Subject: [PATCH 100/153] Added detection testing service results inSuspicious
 Rundll32 with no Command Line Arguments

---
 ...s_rundll32_with_no_command_line_arguments.yml | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index d657c6c6f8..ab6536acaf 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies rundll32.exe with no command line arguments.
   It is unusual for rundll32.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
@@ -17,7 +17,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -69,11 +73,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 7ed4be864e06cc9f274bce67de495a10e7fc4081 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-195-213>
Date: Mon, 20 Sep 2021 18:05:05 +0000
Subject: [PATCH 101/153] Added detection testing service results inSuspicious
 SearchProtocolHost no Command Line Arguments

---
 ...protocolhost_no_command_line_arguments.yml | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index 2e52e91435..6b9c3a6cd7 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments. It is unusual for searchprotocolhost.exe to execute with no command
   line arguments present. This particular behavior is common with malicious software,
@@ -14,11 +14,15 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32
   and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(searchprotocolhost\.exe.{0,4}$)"  | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
@@ -59,11 +63,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 70e1c9a45428f615f2619ff374fc6de44389f7e4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 12:05:05 -0600
Subject: [PATCH 102/153] Update
 office_document_spawned_child_process_to_download.yml

---
 ...ment_spawned_child_process_to_download.yml | 39 ++++++++++---------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml
index 935d3c66b2..e766b51e28 100644
--- a/detections/endpoint/office_document_spawned_child_process_to_download.yml
+++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml
@@ -1,27 +1,28 @@
 name: Office Document Spawned Child Process To Download
 id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
-version: 2
-date: '2021-06-23'
+version: 3
+date: '2021-09-20'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: this search is to detect potential malicious office document executing
+description: This search is to detect potential malicious office document executing
   lolbin child process to download payload or other malware. Since most of the attacker
   abused the capability of office document to execute living on land application to
   blend it to the normal noise in the infected machine to cover its track.
-search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
-  "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*")  NOT(OriginalFileName
-  IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) | stats min(_time)
-  as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process
-  cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") 
+  Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe"))  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances office application and browser may be
   used.
-known_false_positives: default browser not in the filter list
+known_false_positives: Default browser not in the filter list.
 references:
 - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
 tags:
@@ -51,14 +52,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - parent_process_name
-  - process_name
-  - parent_process
-  - cmdline
-  - process_id
-  - OriginalFileName
-  - ProcessGuid
-  - Computer
-  - EventCode
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint

From cd70758c21df2a306b6f9fab628398b5d1f41cc7 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-195-213>
Date: Mon, 20 Sep 2021 18:21:07 +0000
Subject: [PATCH 103/153] Added detection testing service results inOffice
 Document Spawned Child Process To Download

---
 ...ment_spawned_child_process_to_download.yml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml
index e766b51e28..3c20bc426a 100644
--- a/detections/endpoint/office_document_spawned_child_process_to_download.yml
+++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml
@@ -11,12 +11,13 @@ description: This search is to detect potential malicious office document execut
   abused the capability of office document to execute living on land application to
   blend it to the normal noise in the infected machine to cover its track.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") 
-  Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe"))  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process
+  IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe"))  by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `office_document_spawned_child_process_to_download_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -54,11 +55,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 628fe8f257928aeddb49f98e05ceeccdd0c7721e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 20 Sep 2021 12:37:32 -0600
Subject: [PATCH 104/153] removing originalfilename artifacts

---
 detections/endpoint/detect_renamed_7_zip.yml  | 19 ++++++++++-------
 detections/endpoint/detect_renamed_psexec.yml | 19 ++++++++++-------
 detections/endpoint/detect_renamed_rclone.yml | 21 +++++++++++--------
 .../endpoint/detect_sharphound_usage.yml      |  4 ++--
 .../endpoint/dump_lsass_via_procdump.yml      |  2 +-
 ...ious_dllhost_no_command_line_arguments.yml |  3 ++-
 .../endpoint/suspicious_rundll32_rename.yml   |  2 +-
 7 files changed, 40 insertions(+), 30 deletions(-)

diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index 0a522bdafb..28fcfe502d 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -65,13 +65,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 033f2842a0..64b8ffeaa5 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -73,13 +73,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - dest
-  - User
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
-  - CommandLine
-  - Product
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml
index 2bdc5b7bb6..23cb676fc4 100644
--- a/detections/endpoint/detect_renamed_rclone.yml
+++ b/detections/endpoint/detect_renamed_rclone.yml
@@ -18,10 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `detect_renamed_rclone_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited as this analytic identifies
   renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business
   use case.
@@ -70,10 +67,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - OriginalFileName
-  - process_name
-  - process_path
-  - CommandLine
-  - dest
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index cb65357b27..afbd7b2146 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -7,8 +7,8 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies SharpHound binary usage by using the
-  `OriginalFileName`. In addition to renaming the PE, other coverage is available
-  to detect command-line arguments. This particular analytic looks for the OriginalFileName
+  original filena,e. In addition to renaming the PE, other coverage is available
+  to detect command-line arguments. This particular analytic looks for the original_file_name
   of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe
   have different original filenames. Dependent upon the operator, the code may be
   re-compiled and the attributes removed or changed to anything else. During triage,
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 4c97cba1aa..1de3f88d35 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -9,7 +9,7 @@ datamodel:
 description: 'Detect procdump.exe dumping the lsass process. This query looks for
   both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
   file with all process memory. Both are highly suspect and should be reviewed. This
-  query does not monitor for the internal name (OriginalFileName=procdump) of the
+  query does not monitor for the internal name (original_file_name=procdump) of the
   PE or look for procdump64.exe. Modify the query as needed.\
 
   During triage, confirm this is procdump.exe executing. If it is the first time a
diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index da953aeba8..2da1797624 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -4,7 +4,8 @@ version: 2
 date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+  - Endpoint
 description: The following analytic identifies DLLHost.exe with no command line arguments.
   It is unusual for DLLHost.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index c61f510865..173215731d 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies renamed instances of rundll32.exe executing.
   rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
   investigation, validate it is the legitimate rundll32.exe executing and what script
-  content it is loading. This query relies on the OriginalFileName from Sysmon, or
+  content it is loading. This query relies on the original filename or
   internal name from the PE meta data. Expand the query as needed by looking for specific
   command line arguments outlined in other analytics.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

From 2694a294730af83f195c32ad0d115efc0917c172 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-150-243>
Date: Mon, 20 Sep 2021 18:57:27 +0000
Subject: [PATCH 105/153] Added detection testing service results inDetect
 Renamed PSExec

---
 detections/endpoint/detect_renamed_psexec.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 64b8ffeaa5..1376383912 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -12,10 +12,10 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   During triage, validate this is the legitimate version of `PsExec` by reviewing
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_psexec` by
-  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  as lastTime from datamodel=Endpoint.Processes where `process_psexec` by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.original_file_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -75,11 +75,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From e82ed3d21dfdde4c2a1d0e87345fb78522defc64 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-150-243>
Date: Mon, 20 Sep 2021 18:57:34 +0000
Subject: [PATCH 106/153] Added detection testing service results inDetect
 Renamed 7-Zip

---
 detections/endpoint/detect_renamed_7_zip.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index 28fcfe502d..3b871de923 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -67,11 +67,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From c904226897812b14c409c9c7c296df853d4d3df2 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-48-179>
Date: Mon, 20 Sep 2021 18:59:08 +0000
Subject: [PATCH 107/153] Added detection testing service results inDetect
 Renamed RClone

---
 detections/endpoint/detect_renamed_rclone.yml | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml
index 23cb676fc4..c26cf9478a 100644
--- a/detections/endpoint/detect_renamed_rclone.yml
+++ b/detections/endpoint/detect_renamed_rclone.yml
@@ -16,9 +16,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   AND Processes.process_name!=rclone.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_renamed_rclone_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives should be limited as this analytic identifies
   renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business
   use case.
@@ -69,11 +72,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 8761bf0f852989440d9729af8c9fac135e716bb5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Sep 2021 08:19:22 -0600
Subject: [PATCH 108/153] Update windows_event_log_cleared.yml

---
 detections/endpoint/windows_event_log_cleared.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml
index b185e92dbd..61b6926470 100644
--- a/detections/endpoint/windows_event_log_cleared.yml
+++ b/detections/endpoint/windows_event_log_cleared.yml
@@ -11,9 +11,9 @@ description: The following analytic utilizes Windows Security Event ID 1102 or S
   triage, based on time of day and user, determine if this was planned. If not planned,
   follow through with reviewing parallel alerts and other data sources to determine
   what else may have occurred.
-search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
+search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
   | stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 known_false_positives: It is possible that these logs may be legitimately cleared

From 4fafdf721dd212ada461fdd29c42a83351aea6c2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Sep 2021 08:25:16 -0600
Subject: [PATCH 109/153] Update wermgr_process_create_executable_file.yml

Updated to tstat
---
 .../wermgr_process_create_executable_file.yml | 30 ++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml
index dbcd1ec45c..71caefe4b4 100644
--- a/detections/endpoint/wermgr_process_create_executable_file.yml
+++ b/detections/endpoint/wermgr_process_create_executable_file.yml
@@ -1,25 +1,27 @@
 name: Wermgr Process Create Executable File
 id: ab3bcce0-a105-11eb-973c-acde48001122
-version: 1
-date: '2021-04-19'
+version: 2
+date: '2021-09-21'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: this search is designed to detect potential malicious wermgr.exe process
+description: 'This search is designed to detect potential malicious `wermgr.exe` process
   that drops or create executable file. Since wermgr.exe is an application trigger
-  when error encountered in a process, it is really un ussual to this process to drop
+  when error encountered in a process, it is really unusual to this process to drop
   executable file. This technique is commonly seen in trickbot malware where it injects
-  it code to this process to execute it malicious behavior like downloading other
-  payload
-search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
-  | stats  min(_time) as firstTime max(_time) as lastTime count by  Image TargetFilename
-  process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `wermgr_process_create_executable_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+  code to this process to execute it malicious behavior like downloading other
+  payload.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=wermgr.exe  by _time span=1h Processes.process_id Processes.process_name
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.exe" by _time span=1h Filesystem.dest
+  Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
+  | fields _time dest file_create_time file_name file_path process_name process_path
+  process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
+  process_name | `wermgr_process_create_executable_file_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: unknown
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/

From 020f8f8ebc27aea38a684a725877e936aec96365 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-35-81>
Date: Tue, 21 Sep 2021 14:32:55 +0000
Subject: [PATCH 110/153] Added detection testing service results inWinword
 Spawning Cmd

---
 detections/endpoint/winword_spawning_cmd.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml
index 9e530c2845..3be1953d5f 100644
--- a/detections/endpoint/winword_spawning_cmd.yml
+++ b/detections/endpoint/winword_spawning_cmd.yml
@@ -20,7 +20,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `winword_spawning_cmd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
@@ -63,11 +67,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 5423a13fff9c5cd2978f004bff803660d11b78c2 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-40-1>
Date: Tue, 21 Sep 2021 14:35:04 +0000
Subject: [PATCH 111/153] Added detection testing service results inWinword
 Spawning PowerShell

---
 .../endpoint/winword_spawning_powershell.yml  | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml
index 80401febb6..1ba0b16446 100644
--- a/detections/endpoint/winword_spawning_powershell.yml
+++ b/detections/endpoint/winword_spawning_powershell.yml
@@ -15,11 +15,15 @@ description: The following detection identifies Microsoft Word spawning PowerShe
   and identify any files that may have been written.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe"
-  `process_powershell` by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `winword_spawning_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  `process_powershell` by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `winword_spawning_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
@@ -65,11 +69,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From fd83d611f2186484390dd901aa07f3279f0f2a01 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-228-63>
Date: Tue, 21 Sep 2021 14:43:46 +0000
Subject: [PATCH 112/153] Added detection testing service results inWermgr
 Process Spawned CMD Or Powershell Process

---
 ...ocess_spawned_cmd_or_powershell_process.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
index 52ed919ba2..a11923aa97 100644
--- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
@@ -12,12 +12,16 @@ description: This search is designed to detect suspicious cmd and powershell pro
   to run malicious behavior.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process_name = "wermgr.exe" `process_cmd`
-  OR `process_powershell` by Processes.parent_process_name  Processes.original_file_name Processes.parent_process_id  Processes.process_name
+  where Processes.parent_process_name = "wermgr.exe" `process_cmd` OR `process_powershell`
+  by Processes.parent_process_name  Processes.original_file_name Processes.parent_process_id  Processes.process_name
   Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wermgr_process_spawned_cmd_or_powershell_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
@@ -51,11 +55,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 3a276a5de5954c47bf4a491757c9e746cd0663d2 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-40-1>
Date: Tue, 21 Sep 2021 14:52:47 +0000
Subject: [PATCH 113/153] Added detection testing service results inW3WP
 Spawning Shell

---
 detections/endpoint/w3wp_spawning_shell.yml | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 4770d8a3a0..ce8dcabe42 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -17,10 +17,14 @@ description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=w3wp.exe
-  AND `process_cmd` OR `process_powershell` by Processes.dest
-  Processes.parent_process Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process
+  Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` |
+  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Baseline your environment before production. It is possible
   build systems using IIS will spawn cmd.exe to perform a software build. Filter as
   needed.
@@ -60,11 +64,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From c9b15f05c8bad531dd55a887cb770345fa1b1c19 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Sep 2021 09:13:07 -0600
Subject: [PATCH 114/153] Revert "Update
 wermgr_process_create_executable_file.yml"

This reverts commit 4fafdf721dd212ada461fdd29c42a83351aea6c2.
---
 .../wermgr_process_create_executable_file.yml | 30 +++++++++----------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml
index 71caefe4b4..dbcd1ec45c 100644
--- a/detections/endpoint/wermgr_process_create_executable_file.yml
+++ b/detections/endpoint/wermgr_process_create_executable_file.yml
@@ -1,27 +1,25 @@
 name: Wermgr Process Create Executable File
 id: ab3bcce0-a105-11eb-973c-acde48001122
-version: 2
-date: '2021-09-21'
+version: 1
+date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'This search is designed to detect potential malicious `wermgr.exe` process
+description: this search is designed to detect potential malicious wermgr.exe process
   that drops or create executable file. Since wermgr.exe is an application trigger
-  when error encountered in a process, it is really unusual to this process to drop
+  when error encountered in a process, it is really un ussual to this process to drop
   executable file. This technique is commonly seen in trickbot malware where it injects
-  code to this process to execute it malicious behavior like downloading other
-  payload.'
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=wermgr.exe  by _time span=1h Processes.process_id Processes.process_name
-  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
-  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.exe" by _time span=1h Filesystem.dest
-  Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
-  | fields _time dest file_create_time file_name file_path process_name process_path
-  process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
-  process_name | `wermgr_process_create_executable_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  it code to this process to execute it malicious behavior like downloading other
+  payload
+search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
+  | stats  min(_time) as firstTime max(_time) as lastTime count by  Image TargetFilename
+  process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `wermgr_process_create_executable_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
 known_false_positives: unknown
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/

From 71a9bed8f4841de28420ada1ca3360f1066bbdd2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Sep 2021 09:15:56 -0600
Subject: [PATCH 115/153] Revert "Update windows_event_log_cleared.yml"

This reverts commit 8761bf0f852989440d9729af8c9fac135e716bb5.
---
 detections/endpoint/windows_event_log_cleared.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml
index 61b6926470..b185e92dbd 100644
--- a/detections/endpoint/windows_event_log_cleared.yml
+++ b/detections/endpoint/windows_event_log_cleared.yml
@@ -11,9 +11,9 @@ description: The following analytic utilizes Windows Security Event ID 1102 or S
   triage, based on time of day and user, determine if this was planned. If not planned,
   follow through with reviewing parallel alerts and other data sources to determine
   what else may have occurred.
-search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
+search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
   | stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 known_false_positives: It is possible that these logs may be legitimately cleared

From 8b33a65baeb2c7d21976f6b1dbbe55575f9f7013 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Sep 2021 09:24:42 -0600
Subject: [PATCH 116/153] Update schtasks_used_for_forcing_a_reboot.yml

---
 detections/endpoint/schtasks_used_for_forcing_a_reboot.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
index 2773dbae3f..08056b1577 100644
--- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
+++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
@@ -14,9 +14,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `schtasks_used_for_forcing_a_reboot_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting logs
-  with both the process name and command-line from your endpoints. If you are using
-  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may create jobs on systems forcing reboots to
   perform updates, maintenance, etc.
 references: []

From 4d48b65a29c17479b8c931d2f86d642f629d1413 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-139-69>
Date: Tue, 21 Sep 2021 15:40:28 +0000
Subject: [PATCH 117/153] Added detection testing service results inDetect
 Renamed rundll32.exe Rename

---
 .../endpoint/suspicious_rundll32_rename.yml   | 31 +++++++++++--------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index 173215731d..07c01a5c50 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -4,20 +4,25 @@ version: 3
 date: '2021-02-04'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel: 
+datamodel:
 - Endpoint
 description: The following analytic identifies renamed instances of rundll32.exe executing.
   rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
   investigation, validate it is the legitimate rundll32.exe executing and what script
-  content it is loading. This query relies on the original filename or
-  internal name from the PE meta data. Expand the query as needed by looking for specific
-  command line arguments outlined in other analytics.
+  content it is loading. This query relies on the original filename or internal name
+  from the PE meta data. Expand the query as needed by looking for specific command
+  line arguments outlined in other analytics.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_rundll32_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.original_file_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_rename_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
@@ -67,11 +72,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 36922060d92af75db7d2fa214a117ebc88d0378e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-193-21>
Date: Tue, 21 Sep 2021 15:44:56 +0000
Subject: [PATCH 118/153] Added detection testing service results inSuspicious
 Rundll32 dllregisterserver

---
 .../suspicious_rundll32_dllregisterserver.yml  | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index 0efa9f7510..7116e1e610 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -14,12 +14,16 @@ description: The following analytic identifies rundll32.exe using dllregisterser
   parrellel processes executing. Capture the DLL being loaded and inspect further.
   Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
-  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver*
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: This is likely to produce false positives and will require
   some filtering. Tune the query by adding command line paths to known good DLLs,
   or filtering based on parent process names.
@@ -72,11 +76,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 1831d9252f246ac77f4bce41e153976a0edb2284 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-114-129>
Date: Tue, 21 Sep 2021 15:45:08 +0000
Subject: [PATCH 119/153] Added detection testing service results inDetect
 regsvr32 Registering DLLs from non-standard paths

---
 ...ious_regsvr32_register_suspicious_path.yml | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 1409c29f15..6327c94cab 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -11,17 +11,21 @@ description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious
   look for network connections to remote destinations (internal or external). Review
   additional parrallel processes and child processes for additional activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32`
-  (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*)
-  (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` (Processes.process=*appdata*
+  OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll
+  Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
   field in the Endpoint data model. Tune the query by filtering additional extensions
-  found to be used by  legitimate processes. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  found to be used by  legitimate processes. To successfully implement this search
+  you need to be ingesting information on process that include the name of the process
+  responsible for the changes from your endpoints into the `Endpoint` datamodel in
+  the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is
+  installed and the latest TA for the endpoint product.
 known_false_positives: Limited false positives with the query restricted to specified
   paths. Add more world writeable paths as tuning continues.
 references:
@@ -72,11 +76,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 02728836fe6d24d8ffcccc320da0aacabf594a5c Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-114-129>
Date: Tue, 21 Sep 2021 15:45:21 +0000
Subject: [PATCH 120/153] Added detection testing service results inSuspicious
 Rundll32 PluginInit

---
 .../suspicious_rundll32_plugininit.yml         | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml
index 956fbc1fc5..1f38049a11 100644
--- a/detections/endpoint/suspicious_rundll32_plugininit.yml
+++ b/detections/endpoint/suspicious_rundll32_plugininit.yml
@@ -10,12 +10,16 @@ description: This search is to detect a suspicious rundll32.exe process with plu
   parameter. This technique is commonly seen in IceID malware to execute its initial
   dll stager to download another payload to the compromised machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
-  Processes.process=*PluginInit* by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*PluginInit*
+  by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
   Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: third party application may used this dll export name to execute
   function.
 references:
@@ -53,11 +57,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From a2b8f7260218eb4bc6e98e2be6fd36e72bd95e2b Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-250-199>
Date: Tue, 21 Sep 2021 15:48:33 +0000
Subject: [PATCH 121/153] Added detection testing service results inRunDLL
 Loading DLL By Ordinal

---
 .../endpoint/rundll_loading_dll_by_ordinal.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index c95ef9bc78..f60585c5a5 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -13,10 +13,14 @@ description: This search looks for executing scripts with rundll32. Adversaries
   operations.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_rundll32` by Processes.process_name Processes.parent_process_name Processes.original_file_name
-  Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  where `process_rundll32` by Processes.process_name Processes.parent_process_name
+  Processes.original_file_name Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: While not common, loading a DLL under %AppData% and calling
   a function by ordinal is possible by a legitimate process
 references: []
@@ -60,11 +64,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From be20a1455650c41a22b09b37ae4a0d58c536c1b7 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-193-21>
Date: Tue, 21 Sep 2021 15:58:53 +0000
Subject: [PATCH 122/153] Added detection testing service results inRemote WMI
 Command Attempt

---
 .../endpoint/remote_wmi_command_attempt.yml      | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
index ced2e45c67..d0af4cc9ed 100644
--- a/detections/endpoint/remote_wmi_command_attempt.yml
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -12,12 +12,16 @@ description: The following analytic identifies usage of `wmic.exe` spawning a lo
   and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm
   execution or file modifications. Contain and isolate the endpoint as needed.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_wmic`
-  Processes.process=*node* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `remote_wmi_command_attempt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Deprecated because duplicate of Remote Process Instantiation via WMI.
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process=*node*
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product. Deprecated because duplicate of Remote Process Instantiation via
+  WMI.
 known_false_positives: Administrators may use this legitimately to gather info from
   remote systems. Filter as needed.
 references:

From 2727cbf641beaef0557a8ea6ad019262a9f4bba3 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-156-53>
Date: Tue, 21 Sep 2021 17:02:26 +0000
Subject: [PATCH 123/153] Added detection testing service results inRemote
 Process Instantiation via WMI

---
 .../remote_process_instantiation_via_wmi.yml   | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 3add5539d9..5d4cd583e0 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -10,11 +10,15 @@ description: This analytic identifies wmic.exe being launched with parameters to
   a process on a remote system.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_wmic` Processes.process="*/node*" Processes.process="*process*"
-  Processes.process="*call*" Processes.process="*create*"   by Processes.process_name Processes.original_file_name
+  where `process_wmic` Processes.process="*/node*" Processes.process="*process*" Processes.process="*call*"
+  Processes.process="*create*"   by Processes.process_name Processes.original_file_name
   Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: The wmic.exe utility is a benign Windows application. It may
   be used legitimately by Administrators with these parameters for remote system administration,
   but it's relatively uncommon.
@@ -63,11 +67,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 2176d9cf8ee3a64cca56459c96fc98a6d3dd5d80 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-128-103>
Date: Tue, 21 Sep 2021 17:07:50 +0000
Subject: [PATCH 124/153] Added detection testing service results inRecursive
 Delete of Directory In Batch CMD

---
 ...rsive_delete_of_directory_in_batch_cmd.yml | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
index 22511aa7c3..c6ff3b9dc0 100644
--- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
@@ -11,12 +11,16 @@ description: This search is to detect a suspicious commandline designed to delet
   (reddot) where it it tries to delete the files in recycle bin to impaire user from
   recovering deleted files.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_cmd`
-  Processes.process=*/c*  Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*"
-  by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process
-  Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c*  Processes.process=*
+  rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name
+  Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id
+  Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: network operator may use this batch command to delete recursively
   a directory or files within directory
 references:
@@ -39,11 +43,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From cf3ab75feca61b6c988429e4e5c9c53e3e479e34 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-128-103>
Date: Tue, 21 Sep 2021 17:08:44 +0000
Subject: [PATCH 125/153] Added detection testing service results inProcess
 Kill Base On File Path

---
 .../process_kill_base_on_file_path.yml        | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml
index 64c8fa1486..348aa36b7c 100644
--- a/detections/endpoint/process_kill_base_on_file_path.yml
+++ b/detections/endpoint/process_kill_base_on_file_path.yml
@@ -11,11 +11,16 @@ description: The following analytic identifies the use of `wmic.exe` using `dele
   stages of an adversary setting up for mining on an endpoint.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime  from datamodel=Endpoint.Processes where `process_wmic` AND Processes.process="*process*" AND Processes.process="*executablepath*"
-  AND Processes.process="*delete*" by  Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime  from datamodel=Endpoint.Processes where `process_wmic` AND Processes.process="*process*"
+  AND Processes.process="*executablepath*" AND Processes.process="*delete*" by  Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `process_kill_base_on_file_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Unknown.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -53,11 +58,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From a3841cbfe5180774c65ab684db4bff1abc751a7f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-194>
Date: Tue, 21 Sep 2021 17:38:23 +0000
Subject: [PATCH 126/153] Added detection testing service results inOffice
 Product Spawning CertUtil

---
 .../office_product_spawning_certutil.yml      | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml
index ade292c00e..f7cf768231 100644
--- a/detections/endpoint/office_product_spawning_certutil.yml
+++ b/detections/endpoint/office_product_spawning_certutil.yml
@@ -19,10 +19,15 @@ description: The following detection identifies the latest behavior utilized by
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_certutil`
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_certutil_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_certutil_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://redcanary.com/threat-detection-report/threats/TA551/
@@ -61,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 023199b17a791cc3a7a36320fc7c92e58328fcdc Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-159-203>
Date: Tue, 21 Sep 2021 17:38:24 +0000
Subject: [PATCH 127/153] Added detection testing service results inOffice
 Product Spawning Wmic

---
 .../endpoint/office_product_spawning_wmic.yml | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml
index 620dd8cd38..fa41770c29 100644
--- a/detections/endpoint/office_product_spawning_wmic.yml
+++ b/detections/endpoint/office_product_spawning_wmic.yml
@@ -19,10 +19,15 @@ description: The following detection identifies the latest behavior utilized by
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_wmic`
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name 
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_wmic_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
@@ -63,11 +68,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 6bb6c53e477056e5c7a9db82dec97e5343e7f494 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-159-203>
Date: Tue, 21 Sep 2021 17:38:44 +0000
Subject: [PATCH 128/153] Added detection testing service results inPowerShell
 Start-BitsTransfer

---
 .../powershell_start_bitstransfer.yml         | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml
index b95375f2eb..cc0796f0d5 100644
--- a/detections/endpoint/powershell_start_bitstransfer.yml
+++ b/detections/endpoint/powershell_start_bitstransfer.yml
@@ -14,12 +14,16 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si
   processes and process lineage. Capture any files on disk and review. For the remote
   domain or IP, what is the reputation?
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*start-bitstransfer*
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_start_bitstransfer_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives. It is possible administrators will
   utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
   process or command-line arguments.
@@ -61,11 +65,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 70e705b5beb226f4173846783c9a6187f66eafd7 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-194>
Date: Tue, 21 Sep 2021 17:39:03 +0000
Subject: [PATCH 129/153] Added detection testing service results inOffice
 Product Spawning Rundll32 with no DLL

---
 ...ffice_product_spawning_rundll32_with_no_dll.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
index 639f84fb3b..cfbeb7c686 100644
--- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
+++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
@@ -23,7 +23,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `office_product_spawning_rundll32_with_no_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
@@ -65,11 +69,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From d6d5996a33c6c935524b03a69899fea67000819c Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-194>
Date: Tue, 21 Sep 2021 17:39:18 +0000
Subject: [PATCH 130/153] Added detection testing service results inOffice
 Product Spawning BITSAdmin

---
 .../office_product_spawning_bitsadmin.yml     | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml
index d3469cb4b6..cdb600e6e5 100644
--- a/detections/endpoint/office_product_spawning_bitsadmin.yml
+++ b/detections/endpoint/office_product_spawning_bitsadmin.yml
@@ -20,10 +20,15 @@ description: The following detection identifies the latest behavior utilized by
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_bitsadmin`
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_bitsadmin_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
@@ -61,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 6f3057637435b8f9a774e662cbee76e4dd97bea9 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-159-203>
Date: Tue, 21 Sep 2021 17:54:31 +0000
Subject: [PATCH 131/153] Added detection testing service results inMshta
 spawning Rundll32 OR Regsvr32 Process

---
 ..._spawning_rundll32_or_regsvr32_process.yml | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index ec879cdc2a..653f66065d 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -12,11 +12,15 @@ description: This search is to detect a suspicious mshta.exe process that spawn
   trickbot payload.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  = "mshta.exe"  `process_rundll32` OR `process_regsvr32`
-  by Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")`
-  | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  = "mshta.exe"  `process_rundll32` OR `process_regsvr32` by Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.process_guid
+  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: limitted. this anomaly behavior is not commonly seen in clean
   host.
 references:
@@ -55,14 +59,15 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
+  automated_detection_testing: passed

From 122dca14bab1066d8d4a9d78905c248efa54658f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-159-203>
Date: Tue, 21 Sep 2021 17:54:56 +0000
Subject: [PATCH 132/153] Added detection testing service results inOffice
 Product Spawn CMD Process

---
 .../office_product_spawn_cmd_process.yml      | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml
index 24342a2e97..18328b26f6 100644
--- a/detections/endpoint/office_product_spawn_cmd_process.yml
+++ b/detections/endpoint/office_product_spawn_cmd_process.yml
@@ -15,10 +15,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
   = "powerpnt.exe") `process_cmd` by Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest Processes.original_file_name
-  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
-  | `office_product_spawn_cmd_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
+  Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `office_product_spawn_cmd_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: IT or network admin may create an document automation that
   will run shell script.
 references:
@@ -56,14 +60,15 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
+  automated_detection_testing: passed

From 01f35d011349be526846684d205894ee204f53f5 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-194>
Date: Tue, 21 Sep 2021 17:55:07 +0000
Subject: [PATCH 133/153] Added detection testing service results inNishang
 PowershellTCPOneLine

---
 .../endpoint/nishang_powershelltcponeline.yml | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index f8bd1f3598..e43528e550 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -13,12 +13,16 @@ description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility
   suspicious. Review the reputation of the remote IP or domain contacted by the powershell
   process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  (Processes.process=*Net.Sockets.TCPClient* AND Processes.process=*System.Text.ASCIIEncoding*)
-  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*Net.Sockets.TCPClient*
+  AND Processes.process=*System.Text.ASCIIEncoding*) by Processes.dest Processes.user
+  Processes.parent_process Processes.original_file_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives may be present. Filter as needed based
   on initial analysis.
 references:
@@ -56,11 +60,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 0cbac06b6e008b674ac3066624ce5db08dbc8c03 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-194>
Date: Tue, 21 Sep 2021 17:55:10 +0000
Subject: [PATCH 134/153] Added detection testing service results inOffice
 Application Spawn rundll32 process

---
 .../office_application_spawn_rundll32_process.yml  | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml
index 4038966b36..cad9a40af1 100644
--- a/detections/endpoint/office_application_spawn_rundll32_process.yml
+++ b/detections/endpoint/office_application_spawn_rundll32_process.yml
@@ -17,7 +17,11 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `office_application_spawn_rundll32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://any.run/malware-trends/trickbot
@@ -52,11 +56,11 @@ tags:
   required_fields:
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 4ca0eaa550dae5fcc17823f76e95627fbb16b039 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-159-203>
Date: Tue, 21 Sep 2021 17:55:16 +0000
Subject: [PATCH 135/153] Added detection testing service results inOffice
 Application Spawn Regsvr32 process

---
 ...ice_application_spawn_regsvr32_process.yml | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml
index b6875e2fc6..68bbcc546b 100644
--- a/detections/endpoint/office_application_spawn_regsvr32_process.yml
+++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml
@@ -14,11 +14,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
   = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe") `process_regsvr32`
-  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
-  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
-  | `office_application_spawn_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  by Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
+  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `office_application_spawn_regsvr32_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://www.joesandbox.com/analysis/380662/0/html
@@ -51,11 +55,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 5b56ddb588593118f600b87cd9d1b73a4a136e53 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-159-203>
Date: Tue, 21 Sep 2021 18:10:11 +0000
Subject: [PATCH 136/153] Added detection testing service results inPowershell
 Disable Security Monitoring

---
 ...powershell_disable_security_monitoring.yml | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
index 26a0d07e05..94dde9352f 100644
--- a/detections/endpoint/powershell_disable_security_monitoring.yml
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -12,10 +12,15 @@ description: This search is to identifies a modification in registry to disable
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*"
   AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*")
-  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `powershell_disable_security_monitoring_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives. However, tune based on scripts that
   may perform this action.
 references:
@@ -39,11 +44,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From e2a6903b2616a071ae98ca0f1fa4742eddf01589 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-194>
Date: Tue, 21 Sep 2021 18:14:10 +0000
Subject: [PATCH 137/153] Added detection testing service results inExcessive
 Usage Of Net App

---
 .../endpoint/excessive_usage_of_net_app.yml   | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml
index e246211019..90d4e076d0 100644
--- a/detections/endpoint/excessive_usage_of_net_app.yml
+++ b/detections/endpoint/excessive_usage_of_net_app.yml
@@ -12,10 +12,15 @@ description: This analytic identifies excessive usage of `net.exe` or `net1.exe`
   malicious behavior.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime  from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name
-  Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime  from datamodel=Endpoint.Processes where `process_net` by Processes.process_name
+  Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user
+  _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown. Filter as needed. Modify the time span as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -60,11 +65,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 3010cea72452bb5b9f1bb1325082821a12df2c48 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-194>
Date: Tue, 21 Sep 2021 18:24:38 +0000
Subject: [PATCH 138/153] Added detection testing service results inOffice
 Product Spawning MSHTA

---
 .../office_product_spawning_mshta.yml         | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml
index 00148dc9da..6106b3e695 100644
--- a/detections/endpoint/office_product_spawning_mshta.yml
+++ b/detections/endpoint/office_product_spawning_mshta.yml
@@ -19,10 +19,15 @@ description: The following detection identifies the latest behavior utilized by
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_mshta`
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_mshta_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://redcanary.com/threat-detection-report/threats/TA551/
@@ -61,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 97172e446fe5f679d76a5610e181cbe11dbe77fd Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-159-203>
Date: Tue, 21 Sep 2021 18:25:59 +0000
Subject: [PATCH 139/153] Added detection testing service results inExcessive
 Service Stop Attempt

---
 .../excessive_service_stop_attempt.yml        | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml
index e4398ef01f..4dda001358 100644
--- a/detections/endpoint/excessive_service_stop_attempt.yml
+++ b/detections/endpoint/excessive_service_stop_attempt.yml
@@ -12,13 +12,17 @@ description: This analytic identifies suspicious series of attempt to kill multi
   there objective and evade detections.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime  from datamodel=Endpoint.Processes where `process_net`
-  OR  Processes.process_name = "sc.exe" OR  Processes.process_name = "net1.exe" AND
-  Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name
+  as lastTime  from datamodel=Endpoint.Processes where `process_net` OR  Processes.process_name
+  = "sc.exe" OR  Processes.process_name = "net1.exe" AND Processes.process="*stop*"
+  OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name
   Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
   count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -57,11 +61,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 1c45f4dd023da06d481996b0d8b2129681859407 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-102-80>
Date: Tue, 21 Sep 2021 19:24:28 +0000
Subject: [PATCH 140/153] Added detection testing service results inCertUtil
 With Decode Argument

---
 .../certutil_with_decode_argument.yml         | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml
index b05b500f31..48babdb840 100644
--- a/detections/endpoint/certutil_with_decode_argument.yml
+++ b/detections/endpoint/certutil_with_decode_argument.yml
@@ -15,12 +15,15 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including
   further execution. During triage, identify the source of the file being decoded.
   Review its contents or execution behavior for further analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
-  Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `certutil_with_decode_argument_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Typically seen used to `encode` files, but it is possible to
   see legitimate use of `decode`. Filter based on parent-child relationship, file
   paths, endpoint or user.
@@ -71,11 +74,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 7204cf8a9c6d5849de6c690d2f82184e509ba768 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-100-132>
Date: Tue, 21 Sep 2021 19:27:07 +0000
Subject: [PATCH 141/153] Added detection testing service results inBatch File
 Write to System32

---
 detections/endpoint/batch_file_write_to_system32.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index e01c2c7f80..85a1dab5a8 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -18,7 +18,11 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   | fields _time dest file_create_time file_name file_path process_name process_path
   process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
   process_name  | `batch_file_write_to_system32_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: It is possible for this search to generate a notable event
   for a batch file write to a path that includes the string "system32", but is not
   the actual Windows system directory. As such, you should confirm the path of the
@@ -73,7 +77,7 @@ tags:
   - Filesystem.file_name
   - Filesystem.user
   - Filesystem.file_path
-  - Processes.process_id 
+  - Processes.process_id
   - Processes.process_name
   - Processes.dest
   risk_score: 63

From 9211481e2bcf7e5de9de1874f9efdc3033ddb06d Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-8-152>
Date: Tue, 21 Sep 2021 19:28:19 +0000
Subject: [PATCH 142/153] Added detection testing service results inAttempt To
 Stop Security Service

---
 .../attempt_to_stop_security_service.yml      | 28 +++++++++++--------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml
index 7685b114c8..8dfea2057d 100644
--- a/detections/endpoint/attempt_to_stop_security_service.yml
+++ b/detections/endpoint/attempt_to_stop_security_service.yml
@@ -10,13 +10,17 @@ description: This search looks for attempts to stop security-related services on
   endpoint.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_net` OR  Processes.process_name = sc.exe Processes.process="*
-  stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup
-  security_services_lookup service as process OUTPUTNEW category, description | search
-  category=security | `attempt_to_stop_security_service_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  where `process_net` OR  Processes.process_name = sc.exe Processes.process="* stop
+  *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  |lookup security_services_lookup service as process OUTPUTNEW category, description
+  | search category=security | `attempt_to_stop_security_service_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: None identified. Attempts to disable security-related services
   should be identified and understood.
 references:
@@ -36,7 +40,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log
   impact: 40
   kill_chain_phases:
   - Installation
@@ -74,11 +78,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From badfacb77e5f603ffe874d37ec9868e26dfef264 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-100-132>
Date: Tue, 21 Sep 2021 19:28:43 +0000
Subject: [PATCH 143/153] Added detection testing service results inCertUtil
 Download With VerifyCtl and Split Arguments

---
 ...load_with_verifyctl_and_split_arguments.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index 88a4c40b0f..d35aa4fa46 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -14,12 +14,16 @@ description: 'Certutil.exe may download a file from a remote destination using `
   the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
-  Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl*
+  Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives in most environments, however tune
   as needed based on parent-child relationship or network connection.
 references:
@@ -70,11 +74,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 2ea88aac2ad42a4ee2cc9f6aadba2baa8b9de030 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-8-152>
Date: Tue, 21 Sep 2021 19:28:58 +0000
Subject: [PATCH 144/153] Added detection testing service results inAny
 Powershell DownloadString

---
 .../any_powershell_downloadstring.yml         | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 87487db8c8..72a6433db8 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -12,12 +12,15 @@ description: The following analytic identifies the use of PowerShell downloading
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  Processes.process=*.DownloadString*  by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `any_powershell_downloadstring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString*  by
+  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives may be present and filtering will need to occur
   by parent process or command line argument. It may be required to modify this query
   to an EDR product for more granular coverage.
@@ -67,11 +70,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 1e4a51b5efad7c89e9ab5ad6175645b200846923 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-52-119>
Date: Tue, 21 Sep 2021 19:29:11 +0000
Subject: [PATCH 145/153] Added detection testing service results inAllow File
 And Printing Sharing In Firewall

---
 ..._file_and_printing_sharing_in_firewall.yml | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
index 18c3ec13ee..cb0d37c557 100644
--- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
@@ -10,13 +10,17 @@ description: This search is to detect a suspicious modification of firewall to a
   file and printer sharing. This technique was seen in ransomware to be able to discover
   more machine connected to the compromised host to encrypt more files
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_netsh`
-  Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*"  Processes.process="*enable=Yes*"
+  as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process=
+  "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*"  Processes.process="*enable=Yes*"
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name Processes.original_file_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `allow_file_and_printing_sharing_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
@@ -40,11 +44,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 389002fc9decdff884743dd1b55aaadd681c6e6e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-52-119>
Date: Tue, 21 Sep 2021 19:31:26 +0000
Subject: [PATCH 146/153] Added detection testing service results inAny
 Powershell DownloadFile

---
 .../endpoint/any_powershell_downloadfile.yml  | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index 27b682453f..4c5080f4f5 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -12,12 +12,16 @@ description: The following analytic identifies the use of PowerShell downloading
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  Processes.process=*DownloadFile* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile*
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `any_powershell_downloadfile_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives may be present and filtering will need to occur
   by parent process or command line argument. It may be required to modify this query
   to an EDR product for more granular coverage.
@@ -68,14 +72,15 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
+  automated_detection_testing: passed

From f720679ba3cc0435474d1f6484a682a4dabadbab Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-102-80>
Date: Tue, 21 Sep 2021 19:41:07 +0000
Subject: [PATCH 147/153] Added detection testing service results inAllow
 Network Discovery In Firewall

---
 .../allow_network_discovery_in_firewall.yml   | 26 +++++++++++--------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml
index 410cadec08..aedebe1507 100644
--- a/detections/endpoint/allow_network_discovery_in_firewall.yml
+++ b/detections/endpoint/allow_network_discovery_in_firewall.yml
@@ -11,13 +11,17 @@ description: This search is to detect a suspicious modification to the firewall
   (revil, reddot) to discover other machine connected to the compromised host to encrypt
   more files.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_netsh`
-  Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*"  Processes.process="*enable*"
-  Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process=
+  "*firewall*" Processes.process= "*group=\"Network Discovery\"*"  Processes.process="*enable*"
+  Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process
+  Processes.original_file_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
@@ -42,11 +46,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 4feb74f09a5fd720b27adebd6432ad2ba599b3aa Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-100-132>
Date: Tue, 21 Sep 2021 19:43:19 +0000
Subject: [PATCH 148/153] Added detection testing service results inCertUtil
 Download With URLCache and Split Arguments

---
 ...load_with_urlcache_and_split_arguments.yml | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 9345297797..af05ba2894 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -14,12 +14,16 @@ description: Certutil.exe may download a file from a remote destination using `-
   During triage, capture any files on disk and review. Review the reputation of the
   remote IP or domain in question.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil`
-  Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache*
+  Processes.process=*split* by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.original_file_name
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives in most environments, however tune
   as needed based on parent-child relationship or network connection.
 references:
@@ -69,11 +73,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 863848a8d40519763d611e0d248bed382d5aef2f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-100-132>
Date: Tue, 21 Sep 2021 19:53:32 +0000
Subject: [PATCH 149/153] Added detection testing service results inMalicious
 PowerShell Process - Connect To Internet With Hidden Window

---
 ..._connect_to_internet_with_hidden_window.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
index a401a5757e..72c9271cdf 100644
--- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
@@ -16,10 +16,14 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
   Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*"
-  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.process
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name
+  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
 references: []
@@ -75,11 +79,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 786389451265e11ebb8e258347c7b861c78bf3c5 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-21-126>
Date: Tue, 21 Sep 2021 19:56:36 +0000
Subject: [PATCH 150/153] Added detection testing service results inMalicious
 PowerShell Process - Encoded Command

---
 ...s_powershell_process___encoded_command.yml | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 6327e0e965..9924e356ce 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -10,12 +10,16 @@ description: This search looks for PowerShell processes that have encoded the sc
   within the command-line. Malware has been seen using this parameter, as it obfuscates
   the code and makes it relatively easy to pass a script on the command-line.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user
-  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest
-  Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*-EncodedCommand*
+  OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process
+  Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `malicious_powershell_process___encoded_command_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: System administrators may use this option, but it's not common.
 references: []
 tags:
@@ -60,11 +64,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 71fd03b1ecf82a6adec1451ab6006e89e2c665bb Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-102-80>
Date: Tue, 21 Sep 2021 19:58:12 +0000
Subject: [PATCH 151/153] Added detection testing service results inMalicious
 PowerShell Process - Execution Policy Bypass

---
 ...shell_process___execution_policy_bypass.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index 2457252382..092198c93f 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -13,10 +13,14 @@ description: This search looks for PowerShell processes started with parameters
 search: '| tstats `security_content_summariesonly` values(Processes.process_id) as
   process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process)
   as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_powershell` (Processes.process="* -ex*" OR Processes.process="*
-  bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)`
+  where `process_powershell` (Processes.process="* -ex*" OR Processes.process="* bypass
+  *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: There may be legitimate reasons to bypass the PowerShell execution
   policy. The PowerShell script being run with this parameter should be validated
   to ensure that it is legitimate.
@@ -63,11 +67,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 36476e9d69d87b47950bd29e83e78123914fc2ab Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-242-232>
Date: Tue, 21 Sep 2021 19:59:40 +0000
Subject: [PATCH 152/153] Added detection testing service results inMalicious
 PowerShell Process With Obfuscation Techniques

---
 ...ell_process_with_obfuscation_techniques.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
index 6c9ae33ee4..69aff6f30b 100644
--- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
+++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
@@ -11,12 +11,16 @@ description: This search looks for PowerShell processes launched with arguments
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest
-  Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name
+  Processes.dest Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1)
   + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter`
   | search num_obfuscation > 10 '
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: These characters might be legitimately on the command-line,
   but it is not common.
 references: []
@@ -61,11 +65,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path

From 38ee2f93197df2de55057a05758e060e12fe2bb1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 22 Sep 2021 14:11:27 -0600
Subject: [PATCH 153/153] Revert "Update
 searchprotocolhost_with_no_command_line_with_network.yml"

This reverts commit 958e195593a27f3f4384e1349ce54f7fceba2463.
---
 ...hprotocolhost_with_no_command_line_with_network.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index 0b7f461771..06d912fc42 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -14,14 +14,14 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   related to credential dumping or file writes. searchprotocolhost.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_guid
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_guid [| tstats
+  | regex process="(searchprotocolhost\.exe.{0,4}$)" | join  process_id [| tstats
   `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
-  !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
+  !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
   | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
-  process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
+  process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.