Branch was auto-updated.

detections/endpoint/windows_modify_registry_disable_toast_notifications.yml

@@ -0,0 +1,69 @@
+name: Windows Modify Registry Disable Toast Notifications
+id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84
+version: 1
+date: '2022-06-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is to identify a modification in the Windows registry
+  to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying 
+  user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important 
+  update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion 
+  and execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_disable_toast_notifications_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: administrators may enable or disable this feature that may cause some false positive. 
+references:
+- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry for DisallowRun settings was modified to enable in $dest$
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml

@@ -0,0 +1,69 @@
+name: Windows Modify Registry Disable Windows Security Center Notif
+id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b
+version: 1
+date: '2022-06-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is to identify a modification in the Windows registry
+  to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying 
+  user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important 
+  update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion 
+  and execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_disable_windows_security_center_notif_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: administrators may enable or disable this feature that may cause some false positive. 
+references:
+- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry for security center notification settings was modified to disable mode in $dest$
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml

@@ -0,0 +1,68 @@
+name: Windows Modify Registry Suppress Win Defender Notif
+id: e3b42daf-fff4-429d-bec8-2a199468cea9
+version: 1
+date: '2022-06-22'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is to identify a modification in the Windows registry
+  to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender 
+  on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features 
+  as part of its malicious behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_suppress_win_defender_notif_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: administrators may enable or disable this feature that may cause some false positive. 
+references:
+- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$
+  mitre_attack_id:
+  - T1112
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml

@@ -0,0 +1,74 @@
+name: Windows Remote Services Allow Rdp In Firewall
+id: 9170cb54-ea15-41e1-9dfc-9f3363ce9b02
+version: 1
+date: '2022-06-21'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is to identify a modification in the Windows firewall
+  to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
+  to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some 
+  production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits 
+  of attack to start lateral movement.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
+  values(Processes.parent_process_name) as parent_process values(Processes.process_name)
+  count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" 
+  AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_remote_services_allow_rdp_in_firewall_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+known_false_positives: administrators may enable or disable this feature that may cause some false positive. 
+references:
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: new firewall rules was added to allow rdp connection to $dest$
+  mitre_attack_id:
+  - T1021.001
+  - T1021
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.dest
+  - Processes.user
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_remote_services_allow_remote_assistance.yml

@@ -0,0 +1,70 @@
+name: Windows Remote Services Allow Remote Assistance
+id: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb
+version: 1
+date: '2022-06-21'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic is to identify a modification in the Windows registry
+  to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
+  like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some 
+  production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+  And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_remote_services_allow_remote_assistance_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: administrators may enable or disable this feature that may cause some false positive. 
+references:
+- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry for rdp protocol was modified to enable in $dest$
+  mitre_attack_id:
+  - T1021.001
+  - T1021
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_remote_services_rdp_enable.yml

@@ -0,0 +1,68 @@
+name: Windows Remote Services Rdp Enable
+id: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0
+version: 1
+date: '2022-06-21'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic is to identify a modification in the Windows registry
+  to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
+  to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some 
+  production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_remote_services_rdp_enable_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: administrators may enable or disable this feature that may cause some false positive. 
+references:
+- https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: the registry for rdp protocol was modified to enable in $dest$
+  mitre_attack_id:
+  - T1021.001
+  - T1021
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_service_stop_by_deletion.yml

@@ -0,0 +1,75 @@
+name: Windows Service Stop By Deletion
+id: 196ff536-58d9-4d1b-9686-b176b04e430b
+version: 1
+date: '2022-06-21'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies Windows Service Control, `sc.exe`,
+  attempting to delete a service. This is typically identified in parallel with other
+  instances of service enumeration of attempts to stop a service and then delete it.
+  Adversaries utilize this technique to terminate security services or other related
+  services to continue there objective and evade detections.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_service_stop_by_deletion_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: It is possible administrative scripts may start/stop/delete
+  services. Filter as needed.
+references:
+- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
+tags:
+  analytic_story:
+  - Azorult
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ attempting to delete a service.
+  mitre_attack_id:
+  - T1489
+  nist:
+  - DE.CM
+  observable:
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.dest
+  - Processes.user
+  risk_score: 49
+  security_domain: endpoint

tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry Disable Toast Notifications Unit Test
+tests:
+- name: Windows Modify Registry Disable Toast Notifications
+  file: endpoint/windows_modify_registry_disable_toast_notifications.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_modify_registry_disable_windows_security_center_notif.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry Disable Windows Security Center Notif Unit Test
+tests:
+- name: Windows Modify Registry Disable Windows Security Center Notif
+  file: endpoint/windows_modify_registry_disable_windows_security_center_notif.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_modify_registry_suppress_win_defender_notif.test.yml

@@ -0,0 +1,13 @@
+name: Windows Modify Registry Suppress Win Defender Notif Unit Test
+tests:
+- name: Windows Modify Registry Suppress Win Defender Notif
+  file: endpoint/windows_modify_registry_suppress_win_defender_notif.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml

@@ -0,0 +1,13 @@
+name: Windows Remote Services Allow Rdp In Firewall Unit Test
+tests:
+- name: Windows Remote Services Allow Rdp In Firewall
+  file: endpoint/windows_remote_services_allow_rdp_in_firewall.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml

@@ -0,0 +1,13 @@
+name: Windows Remote Services Allow Remote Assistance Unit Test
+tests:
+- name: Windows Remote Services Allow Remote Assistance
+  file: endpoint/windows_remote_services_allow_remote_assistance.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_remote_services_rdp_enable.test.yml

@@ -0,0 +1,13 @@
+name: Windows Remote Services Rdp Enable Unit Test
+tests:
+- name: Windows Remote Services Rdp Enable
+  file: endpoint/windows_remote_services_rdp_enable.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_service_stop_by_deletion.test.yml

@@ -0,0 +1,13 @@
+name: Windows Service Stop By Deletion Unit Test
+tests:
+- name: Windows Service Stop By Deletion
+  file: endpoint/windows_service_stop_by_deletion.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true