Branch was auto-updated.

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.61.0"
+      "version": "3.62.0"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-07T23:30:17 UTC
+# On Date: 2023-03-21T21:34:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -9715,7 +9715,7 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001", "T1059", "T1562.001", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = administrators may execute this command that may cause some false positive.
 providing_technologies = ["Microsoft Windows"]
 
@@ -10039,6 +10039,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
 known_false_positives = Administrators or power users may use this command for troubleshooting.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Rundll32 WebDAV Request - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+how_to_implement = In addition to getting the correct data, adding a join with network connection will assist with making this higher fidelity. We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Scheduled Task with Highest Privileges - Rule]
 type = detection
 asset_type = Endpoint
@@ -10882,6 +10892,39 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
 providing_technologies = null
 
+[savedsearch://ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Okta Multiple Failed Requests to Access Applications - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+* Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+* Groups by User, Session and IP \
+* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+* Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.
+how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.004", "T1538"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present based on organization size and configuration of Okta.
+providing_technologies = null
+
 [savedsearch://ESCU - Okta New API Token Created - Rule]
 type = detection
 asset_type = Infrastructure
@@ -10902,6 +10945,16 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = Tune the risk score as needed based on your organization.
 providing_technologies = null
 
+[savedsearch://ESCU - Okta Phishing Detection with FastPass Origin Check - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1556"], "nist": ["DE.CM"]}
+known_false_positives = Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Okta Suspicious Activity Reported - Rule]
 type = detection
 asset_type = Infrastructure
@@ -10912,6 +10965,39 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = False positives should be limited as this is a high fidelity marker.
 providing_technologies = null
 
+[savedsearch://ESCU - Okta Suspicious Use of a Session Cookie - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
+* Retrieves policy evaluation events from successful authentication events. \
+* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
+* Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.
+how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1539"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present based on organization size and configuration of Okta.
+providing_technologies = null
+
+[savedsearch://ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1110.004"], "nist": ["DE.CM"]}
+known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule]
+type = detection
+asset_type = Infrastructure
+confidence = medium
+explanation = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1110.003"], "nist": ["DE.CM"]}
+known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Okta ThreatInsight Threat Detected - Rule]
 type = detection
 asset_type = Infrastructure
@@ -11687,12 +11773,22 @@ providing_technologies = null
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = The following analytic identifies the process name of java.exe and w3wp.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
+explanation = The following analytic identifies the process name of java.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. Restrict the analytic to publicly facing endpoints to reduce false positives. Add any additional identified web application process name to the query. Add any further Windows process names to the macro (ex. LOLBins) to further expand this query.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on that.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Rundll32 WebDav With Network Connection - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+how_to_implement = We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and the All_Traffic Datamodel. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Vulnerable Driver Loaded - Rule]
 type = detection
 asset_type = Endpoint
@@ -12861,6 +12957,28 @@ searches = ["ESCU - Fortinet Appliance Auth bypass - Rule"]
 description = Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684.
 narrative = FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai)
 
+[analytic_story://CVE-2023-21716 Word RTF Heap Corruption]
+category = Adversary Tactics
+last_updated = 2023-03-10
+version = 1
+references = ["https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Office Application Drop Executable - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Winword Spawning Windows Script Host - Rule"]
+description = A proof-of-concept for CVE-2023-21716, a critical vulnerability in Microsoft Word that allows remote code execution utilizing a heap corruption in rich text files.
+narrative = This analytic story covers content that will assist organizations in identifying potential RTF RCE abuse on endpoints. The vulnerability was assigned a 9.8 out of 10 severity score, with Microsoft addressing it in the February Patch Tuesday security updates along with a couple of workarounds. Security researcher Joshua Drake last year discovered the vulnerability in Microsoft Office''s "wwlib.dll" and sent Microsoft a technical advisory containing proof-of-concept (PoC) code showing the issue is exploitable. A remote attacker could potentially take advantage of the issue to execute code with the same privileges as the victim that opens a malicious .RTF document. Delivering the malicious file to a victim can be as easy as an attachment to an email, although plenty of other methods exist. Microsoft warns that users don''t have to open a malicious RTF document and simply loading the file in the Preview Pane is enough for the compromise to start. (BleepingComputer, 2023)
+
+[analytic_story://CVE-2023-23397 Outlook Elevation of Privilege]
+category = Adversary Tactics
+last_updated = 2023-03-15
+version = 1
+references = ["https://twitter.com/ACEResponder/status/1636116096506818562?s=20", "https://twitter.com/domchell/status/1635999068282408962?s=20", "https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/", "https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Windows Rundll32 WebDAV Request - Rule", "ESCU - Windows Rundll32 WebDav With Network Connection - Rule"]
+description = Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows.
+narrative = Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\ CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\ The connection to the remote SMB server sends the user''s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. Online services such as Microsoft 365 do not support NTLM authentication and are not vulnerable to being attacked by these messages. (2023, Microsoft)
+
 [analytic_story://CyclopsBLink]
 category = Malware
 last_updated = 2022-04-07
@@ -13665,7 +13783,7 @@ version = 1
 references = ["https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/", "https://www.csoonline.com/article/3674156/multi-factor-authentication-fatigue-attacks-are-on-the-rise-how-to-defend-against-them.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule"]
+searches = ["ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule"]
 description = A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks.
 narrative = An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device. The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of "fatigue" regarding these MFA prompts.
 
@@ -14237,7 +14355,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta New API Token Created - Rule", "ESCU - Okta New Device Enrolled on Account - Rule", "ESCU - Okta Suspicious Activity Reported - Rule", "ESCU - Okta ThreatInsight Threat Detected - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"]
+searches = ["ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule", "ESCU - Okta Multiple Failed Requests to Access Applications - Rule", "ESCU - Okta New API Token Created - Rule", "ESCU - Okta New Device Enrolled on Account - Rule", "ESCU - Okta Phishing Detection with FastPass Origin Check - Rule", "ESCU - Okta Suspicious Activity Reported - Rule", "ESCU - Okta Suspicious Use of a Session Cookie - Rule", "ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule", "ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule", "ESCU - Okta ThreatInsight Threat Detected - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"]
 description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.
 narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \
 While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 12368
+build = 12515
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.61.0
+version = 3.62.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-07T23:30:17 UTC
+# On Date: 2023-03-21T21:34:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.61.0
+version = 3.62.0

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-07T23:30:17 UTC
+# On Date: 2023-03-21T21:34:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-07T23:30:17 UTC
+# On Date: 2023-03-21T21:34:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -3945,6 +3945,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_rundll32_webdav_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_scheduled_task_with_highest_privileges_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4269,6 +4273,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[okta_mismatch_between_source_and_response_for_verify_push_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_multiple_failed_requests_to_access_applications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [okta_new_api_token_created_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4277,10 +4289,26 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[okta_phishing_detection_with_fastpass_origin_check_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [okta_suspicious_activity_reported_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[okta_suspicious_use_of_a_session_cookie_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_threatinsight_login_failure_with_high_unknown_users_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_threatinsight_suspected_passwordspray_attack_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [okta_threatinsight_threat_detected_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4581,6 +4609,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_rundll32_webdav_with_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_vulnerable_driver_loaded_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-07T23:30:17 UTC
+# On Date: 2023-03-21T21:34:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -9571,12 +9571,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Deprecated - Windows connhost exe started forcefully - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk. 
-action.notable.param.rule_title = Windows connhost exe started forcefully
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -10019,12 +10013,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule.
-action.notable.param.rule_title = Allow Inbound Traffic By Firewall Rule Registry
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -25133,12 +25121,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Modification Of Wallpaper - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware", "Windows Registry Abuse", "Brute Ratel C4", "LockBit Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper.
-action.notable.param.rule_title = Modification Of Wallpaper
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -25513,8 +25495,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 action.escu.known_false_positives = quite minimal false positive expected.
-action.escu.creation_date = 2021-07-05
-action.escu.modification_date = 2021-07-05
+action.escu.creation_date = 2023-03-15
+action.escu.modification_date = 2023-03-15
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Msmpeng Application DLL Side Loading - Rule
 action.escu.search_type = detection
@@ -25548,7 +25530,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = |tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`
+search = |tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND NOT (Filesystem.file_path IN ("*\\Program Files\\windows defender\\*","*\\WinSxS\\*defender-service*","*\\WinSxS\\Temp\\*defender-service*")) by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`
 
 [ESCU - Net Localgroup Discovery - Rule]
 action.escu = 0
@@ -26082,7 +26064,7 @@ action.escu.full_search_name = ESCU - Office Application Drop Executable - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["FIN7", "AgentTesla"]
+action.escu.analytic_story = ["FIN7", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ drops a file $file_name$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -26093,7 +26075,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Office Application Drop Executable - Rule
-action.correlationsearch.annotations = {"analytic_story": ["FIN7", "AgentTesla"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
+action.correlationsearch.annotations = {"analytic_story": ["FIN7", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -26358,7 +26340,7 @@ action.escu.full_search_name = ESCU - Office Product Spawn CMD Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla"]
+action.escu.analytic_story = ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
@@ -26369,7 +26351,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Office Product Spawn CMD Process - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
+action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "DarkCrystal RAT", "Azorult", "Remcos", "Qakbot", "AgentTesla", "CVE-2023-21716 Word RTF Heap Corruption"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -27144,12 +27126,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Possible Lateral Movement PowerShell Spawn - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Active Directory Lateral Movement", "Malicious PowerShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001", "T1218.014"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution.
-action.notable.param.rule_title = Possible Lateral Movement PowerShell Spawn
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -27159,7 +27135,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`
 
 [ESCU - Potential password in username - Rule]
 action.escu = 0
@@ -28451,12 +28427,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Process Execution via WMI - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. During triage, review parallel processes for suspicious behavior or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. Contain and remediate the endpoint as necessary.
-action.notable.param.rule_title = Process Execution via WMI
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -32342,8 +32312,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
-action.escu.creation_date = 2022-03-15
-action.escu.modification_date = 2022-03-15
+action.escu.creation_date = 2023-03-08
+action.escu.modification_date = 2023-03-08
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious DLLHost no Command Line Arguments - Rule
 action.escu.search_type = detection
@@ -32362,12 +32332,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious DLLHost no Command Line Arguments - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-action.notable.param.rule_title = Suspicious DLLHost no Command Line Arguments
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -33089,12 +33053,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Process File Path - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "DarkCrystal RAT", "Brute Ratel C4", "AgentTesla", "Qakbot", "IcedID", "Trickbot", "Azorult", "Prestige Ransomware", "Chaos Ransomware", "LockBit Ransomware", "AsyncRAT", "Swift Slicer"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious software. This behavior has been used by adversaries where they drop and run an exe in a path that is accessible without admin privileges.
-action.notable.param.rule_title = Suspicious Process File Path
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -33399,12 +33357,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "cve": ["CVE-2021-34527"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-action.notable.param.rule_title = Suspicious Rundll32 no Command Line Arguments
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -33724,7 +33676,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`
 
 [ESCU - System Info Gathering Using Dxdiag Application - Rule]
 action.escu = 0
@@ -34235,12 +34187,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Unknown Process Using The Kerberos Protocol - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Active Directory Kerberos Attacks"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1550"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies a process performing an outbound connection on port 88 used by default by the network authentication protocol Kerberos. Typically, on a regular Windows endpoint, only the lsass.exe process is the one tasked with connecting to the Kerberos Distribution Center to obtain Kerberos tickets. Identifying an unknown process using this protocol may be evidence of an adversary abusing the Kerberos protocol.
-action.notable.param.rule_title = Unknown Process Using The Kerberos Protocol
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -35977,12 +35923,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Boot or Logon Autostart Execution In Startup Folder - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Chaos Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["DE.CM"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic will identify suspicious files dropped or created in the Windows %startup% folder. This technique is a common way to gain persistence on a targeted host. Threat actor, adversaries and red teamer abuse this folder path to automatically execute their malicious sample upon boot or restart of the infected host. This TTP detection is a good indicator that a suspicious process wants to gain persistence on the targeted host. We suggest to verify the process name by using the process guid field, the file created and also the user and the computer name for further investigation.
-action.notable.param.rule_title = Windows Boot or Logon Autostart Execution In Startup Folder
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -37641,12 +37581,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows DLL Side-Loading Process Child Of Calc - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Qakbot"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.CM"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
-action.notable.param.rule_title = Windows DLL Side-Loading Process Child Of Calc
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -37656,7 +37590,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe" by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`
 
 [ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 action.escu = 0
@@ -41901,7 +41835,7 @@ search = `powershell` EventCode=4104 ScriptBlockText IN("*New-WebGlobalModule*",
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
-action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001", "T1059", "T1562.001", "T1562"], "nist": ["DE.CM"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -41924,7 +41858,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Powershell Import Applocker Policy - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001", "T1059", "T1562.001", "T1562"], "nist": ["DE.CM"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -42798,12 +42732,6 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Registry Delete Task SD - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Windows Registry Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"]}
 schedule_window = auto
-action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task. This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. In addition, in order to perform this action, the user context will need to be SYSTEM.
-action.notable.param.rule_title = Windows Registry Delete Task SD
-action.notable.param.security_domain = endpoint
-action.notable.param.severity = high
 alert.digest_mode = 1
 disabled = true
 enableSched = 1
@@ -43337,6 +43265,52 @@ realtime_schedule = 0
 is_visible = false
 search = `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_root_domain_linked_policies_discovery_filter`
 
+[ESCU - Windows Rundll32 WebDAV Request - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.how_to_implement = In addition to getting the correct data, adding a join with network connection will assist with making this higher fidelity. We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+action.escu.creation_date = 2023-03-15
+action.escu.modification_date = 2023-03-15
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Rundll32 WebDAV Request - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["CVE-2023-23397 Outlook Elevation of Privilege"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Rundll32 WebDAV Request - Rule
+action.correlationsearch.annotations = {"analytic_story": ["CVE-2023-23397 Outlook Elevation of Privilege"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Exfiltration"], "cve": ["CVE-2023-23397"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+action.notable.param.rule_title = Windows Rundll32 WebDAV Request
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*","*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`
+
 [ESCU - Windows Scheduled Task with Highest Privileges - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -45721,7 +45695,7 @@ action.escu.full_search_name = ESCU - Winword Spawning Cmd - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT"]
+action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -45732,7 +45706,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Winword Spawning Cmd - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
+action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -45767,7 +45741,7 @@ action.escu.full_search_name = ESCU - Winword Spawning PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT"]
+action.escu.analytic_story = ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -45778,7 +45752,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Winword Spawning PowerShell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
+action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "DarkCrystal RAT", "CVE-2023-21716 Word RTF Heap Corruption"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -45813,7 +45787,7 @@ action.escu.full_search_name = ESCU - Winword Spawning Windows Script Host - Rul
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Spearphishing Attachments"]
+action.escu.analytic_story = ["Spearphishing Attachments", "CVE-2023-21716 Word RTF Heap Corruption"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -45824,7 +45798,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
+action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "CVE-2023-21716 Word RTF Heap Corruption"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -46118,7 +46092,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe) NOT Processes.process=unknown (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`
 
 [ESCU - Wscript Or Cscript Suspicious Child Process - Rule]
 action.escu = 0
@@ -46850,6 +46824,127 @@ realtime_schedule = 0
 is_visible = false
 search = `okta` eventType=system.push.send_factor_verify_push OR ((legacyEventType=core.user.factor.attempt_success) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) OR ((legacyEventType=core.user.factor.attempt_fail) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) | stats count(eval(legacyEventType="core.user.factor.attempt_success")) as successes count(eval(legacyEventType="core.user.factor.attempt_fail")) as failures count(eval(eventType="system.push.send_factor_verify_push")) as pushes by authenticationContext.externalSessionId,user,_time | stats latest(_time) as lasttime earliest(_time) as firsttime sum(successes) as successes sum(failures) as failures sum(pushes) as pushes by authenticationContext.externalSessionId,user | eval seconds=lasttime-firsttime | eval lasttime=strftime(lasttime, "%c") | search (pushes>1) | eval totalattempts=successes+failures | eval finding="Normal authentication pattern" | eval finding=if(failures==pushes AND pushes>1,"Authentication attempts not successful because multiple pushes denied",finding) | eval finding=if(totalattempts==0,"Multiple pushes sent and ignored",finding) | eval finding=if(successes>0 AND pushes>3,"Probably should investigate. Multiple pushes sent, eventual successful authentication!",finding) | where seconds<600 AND finding="Multiple pushes sent, eventual successful authentication!" AND totalattempts > 5 | sort - pushes, totalattempts | `okta_mfa_exhaustion_hunt_filter`
 
+[ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+action.escu.how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+action.escu.known_false_positives = False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
+action.escu.creation_date = 2023-03-17
+action.escu.modification_date = 2023-03-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity", "Okta MFA Exhaustion"]
+action.risk = 1
+action.risk.param._risk_message = A mismatch between source and response for verifying a push request has occurred for $actor.alternateId$
+action.risk.param._risk = [{"risk_object_field": "actor.alternateId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Mismatch Between Source and Response for Verify Push Request - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity", "Okta MFA Exhaustion"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1621"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
+For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
+Source of Push (Sign-In) \
+eventType eq \"system.push.send_factor_verify_push\" \
+User Push Response (Okta Verify client) \
+eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
+In sequence, the logic for the analytic - \
+* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
+* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ * Creates a ratio of successful sign-ins to pushes. \
+* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.
+action.notable.param.rule_title = Okta Mismatch Between Source and Response for Verify Push Request
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType IN (system.push.send_factor_verify_push) OR (eventType IN (user.authentication.auth_via_mfa) debugContext.debugData.factor="OKTA_VERIFY_PUSH") | eval groupby="authenticationContext.externalSessionId" | eval group_push_time=_time | bin span=2s group_push_time | fillnull value=NULL | stats min(_time) as _time by authenticationContext.externalSessionId eventType debugContext.debugData.factor outcome.result actor.alternateId client.device client.ipAddress client.userAgent.rawUserAgent debugContext.debugData.behaviors group_push_time groupby | iplocation client.ipAddress | fields - lat, lon, group_push_time | stats min(_time) as _time dc(client.ipAddress) as dc_ip sum(eval(if(eventType="system.push.send_factor_verify_push" AND "outcome.result"="SUCCESS",1,0))) as total_pushes sum(eval(if(eventType="user.authentication.auth_via_mfa" AND "outcome.result"="SUCCESS",1,0))) as total_successes sum(eval(if(eventType="user.authentication.auth_via_mfa" AND "outcome.result"="FAILURE",1,0))) as total_rejected sum(eval(if(eventType="system.push.send_factor_verify_push" AND "debugContext.debugData.behaviors" LIKE "%New Device=POSITIVE%",1,0))) as suspect_device_from_source sum(eval(if(eventType="system.push.send_factor_verify_push" AND "debugContext.debugData.behaviors" LIKE "%New IP=POSITIVE%",0,0))) as suspect_ip_from_source values(eval(if(eventType="system.push.send_factor_verify_push","client.ipAddress",""))) as src values(eval(if(eventType="user.authentication.auth_via_mfa","client.ipAddress",""))) as dest values(*) as * by groupby | eval ratio = round(total_successes/total_pushes,2) | search ((ratio < 0.5 AND total_pushes > 1) OR (total_rejected > 0)) AND dc_ip > 1 AND suspect_device_from_source > 0 AND suspect_ip_from_source > 0 | `okta_mismatch_between_source_and_response_for_verify_push_request_filter`
+
+[ESCU - Okta Multiple Failed Requests to Access Applications - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+* Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+* Groups by User, Session and IP \
+* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+* Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.004", "T1538"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ * Retrieves policy evaluation and SSO details in events that contain the Application requested \
+* Formats target fields so we can aggregate specifically on Applications (AppInstances) \
+* Groups by User, Session and IP \
+* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
+* Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.
+action.escu.how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+action.escu.known_false_positives = False positives may be present based on organization size and configuration of Okta.
+action.escu.creation_date = 2023-03-17
+action.escu.modification_date = 2023-03-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Multiple Failed Requests to Access Applications - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = Multiple Failed Requests to Access Applications via Okta for $actor.alternateId$.
+action.risk.param._risk = [{"risk_object_field": "actor.alternateId", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Multiple Failed Requests to Access Applications - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.004", "T1538"], "nist": ["DE.CM"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', ": ") | eval targets=mvfilter(targets LIKE "AppInstance%") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" | fields - count, targets | search ratio < 0.5 total_challenges > 2` | okta_multiple_failed_requests_to_access_applications_filter`
+
 [ESCU - Okta New API Token Created - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -46936,6 +47031,52 @@ realtime_schedule = 0
 is_visible = false
 search = `okta` eventType=system.email.new_device_notification.sent_message displayMessage="Send user new device notification email" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_new_device_enrolled_on_account_filter`
 
+[ESCU - Okta Phishing Detection with FastPass Origin Check - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1556"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+action.escu.how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+action.escu.known_false_positives = Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
+action.escu.creation_date = 2023-03-09
+action.escu.modification_date = 2023-03-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Phishing Detection with FastPass Origin Check - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = Okta FastPass has prevented $user$ from authenticating to a malicious site.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Phishing Detection with FastPass Origin Check - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Stage:Credential Access", "Other:Brute Force"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1556"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. Okta''s Defensive Cyber Operations team routinely identifies phishing infrastructure configured to imitate an Okta sign-in page and proactively notify Okta customers when suspicious infrastructure we detect appears to be targeting their users. Since March 2020, we have delivered over 1000 notifications to customers.
+action.notable.param.rule_title = Okta Phishing Detection with FastPass Origin Check
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_phishing_detection_with_fastpass_origin_check_filter`
+
 [ESCU - Okta Suspicious Activity Reported - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -46982,6 +47123,144 @@ realtime_schedule = 0
 is_visible = false
 search = `okta` eventType=user.account.report_suspicious_activity_by_enduser | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_suspicious_activity_reported_filter`
 
+[ESCU - Okta Suspicious Use of a Session Cookie - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
+* Retrieves policy evaluation events from successful authentication events. \
+* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
+* Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1539"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
+* Retrieves policy evaluation events from successful authentication events. \
+* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
+* Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.
+action.escu.how_to_implement = This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+action.escu.known_false_positives = False positives may be present based on organization size and configuration of Okta.
+action.escu.creation_date = 2023-03-17
+action.escu.modification_date = 2023-03-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta Suspicious Use of a Session Cookie - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = A suspicious use of a session cookie was identified by user $actor.alternateId$.
+action.risk.param._risk = [{"risk_object_field": "actor.alternateId", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta Suspicious Use of a Session Cookie - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1539"], "nist": ["DE.CM"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType IN (policy.evaluate_sign_on) outcome.result IN (ALLOW, SUCCESS) | stats earliest(_time) as _time values(client.ipAddress) as src_ip values(client.userAgent.rawUserAgent) as user_agent values(client.userAgent.os) as userAgentOS_list values(client.geographicalContext.city) as city values(client.userAgent.browser) as userAgentBrowser_list values(device.os_platform) as okta_device_os dc(client.userAgent.browser) as dc_userAgentBrowser dc(client.userAgent.os) as dc_userAgentOS dc(client.ipAddress) as dc_src_ip values(outcome.reason) as reason by debugContext.debugData.dtHash actor.alternateId | where dc_src_ip>1 AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1) | `okta_suspicious_use_of_a_session_cookie_filter`
+
+[ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1110.004"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+action.escu.known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+action.escu.creation_date = 2023-03-09
+action.escu.modification_date = 2023-03-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = Okta ThreatInsight has detected or prevented a high number of login failures.
+action.risk.param._risk = []
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Stage:Credential Access", "Other:Brute Force"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1110.004"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.notable.param.rule_title = Okta ThreatInsight Login Failure with High Unknown users
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType="security.threat.detected" AND outcome.reason="Login failures with high unknown users count*" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_threatinsight_login_failure_with_high_unknown_users_filter`
+
+[ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1110.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.escu.how_to_implement = This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
+action.escu.known_false_positives = Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
+action.escu.creation_date = 2023-03-09
+action.escu.modification_date = 2023-03-09
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Suspicious Okta Activity"]
+action.risk = 1
+action.risk.param._risk_message = Okta ThreatInsight has detected or prevented a PasswordSpray attack.
+action.risk.param._risk = []
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "confidence": 100, "context": ["Stage:Credential Access", "Other:Brute Force"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001", "T1110.003"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
+action.notable.param.rule_title = Okta ThreatInsight Suspected PasswordSpray Attack
+action.notable.param.security_domain = access
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `okta` eventType="security.threat.detected" AND outcome.reason="Password Spray" | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_threatinsight_suspected_passwordspray_attack_filter`
+
 [ESCU - Okta ThreatInsight Threat Detected - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -50170,14 +50449,14 @@ search = `driverinventory` | stats values(Path) min(_time) as firstTime max(_tim
 [ESCU - Windows Java Spawning Shells - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following analytic identifies the process name of java.exe and w3wp.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
+description = The following analytic identifies the process name of java.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = The following analytic identifies the process name of java.exe and w3wp.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
+action.escu.eli5 = The following analytic identifies the process name of java.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. Restrict the analytic to publicly facing endpoints to reduce false positives. Add any additional identified web application process name to the query. Add any further Windows process names to the macro (ex. LOLBins) to further expand this query.
 action.escu.known_false_positives = Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on that.
-action.escu.creation_date = 2023-01-23
-action.escu.modification_date = 2023-01-23
+action.escu.creation_date = 2023-03-09
+action.escu.modification_date = 2023-03-09
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Java Spawning Shells - Rule
 action.escu.search_type = detection
@@ -50198,7 +50477,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-4
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies the process name of java.exe and w3wp.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
+action.notable.param.rule_description = The following analytic identifies the process name of java.exe spawning a Windows shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). The shells included in the macro are "cmd.exe", "powershell.exe". Upon triage, review parallel processes and command-line arguments to determine legitimacy.
 action.notable.param.rule_title = Windows Java Spawning Shells
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -50211,7 +50490,53 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java.exe OR Processes.parent_process_name=w3wp.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_java_spawning_shells_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_java_spawning_shells_filter`
+
+[ESCU - Windows Rundll32 WebDav With Network Connection - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+action.escu.how_to_implement = We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and the All_Traffic Datamodel. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be present based on legitimate software, filtering may need to occur.
+action.escu.creation_date = 2023-03-16
+action.escu.modification_date = 2023-03-16
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Rundll32 WebDav With Network Connection - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["CVE-2023-23397 Outlook Elevation of Privilege"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Rundll32 WebDav With Network Connection - Rule
+action.correlationsearch.annotations = {"analytic_story": ["CVE-2023-23397 Outlook Elevation of Privilege"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Exfiltration"], "cve": ["CVE-2023-23397"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+action.notable.param.rule_title = Windows Rundll32 WebDav With Network Connection
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name=svchost.exe `process_rundll32` Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*", "*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest as src | join host process_id [ | tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port!=0 NOT (All_Traffic.dest_ip IN (10.0.0.0/12, 172.16.0.0/12, 192.168.0.0/16))  by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `windows_rundll32_webdav_with_network_connection_filter`
 
 [ESCU - Windows Vulnerable Driver Loaded - Rule]
 action.escu = 0

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-07T23:30:17 UTC
+# On Date: 2023-03-21T21:34:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -338,15 +338,14 @@ case_sensitive_match = false
 # description = A list of file extensions that are associated with ransomware
 match_type = WILDCARD(Extensions)
 min_matches = 1
-case_sensitive_match = false
 
 [ransomware_notes_lookup]
 filename = ransomware_notes.csv
 default_match = false
+case_sensitive_match = false
 # description = A list of file names that are ransomware note files
 match_type = WILDCARD(ransomware_notes)
 min_matches = 1
-case_sensitive_match = false
 
 [remote_access_software]
 filename = remote_access_software.csv

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-07T23:30:17 UTC
+# On Date: 2023-03-21T21:34:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/lookups/ransomware_extensions.csv

@@ -299,3 +299,4 @@ Extensions,Name
 .MILIHPEN,Milihpen
 .GANGBANG,Gangbang
 .reddot,RedDot
+.MEDUSA,Medusa

dist/escu/lookups/ransomware_notes.csv

@@ -69,4 +69,6 @@ MILIHPEN-INSTRUCT.txt,True
 GANGBANG-NOTE.txt,True
 GET_YOUR_FILES_BACK.txt,True
 read_it.txt,True
-*.README.txt, True
+*.README.txt, True
+*READ_ME_MEDUSA*.TXT,True
+How_to_back_files.HTML,True

dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Suspicious Command-Line Executions
   - Insider Threat
+  - CVE-2023-21716 Word RTF Heap Corruption
   cis20:
   - CIS 8
   kill_chain_phases: