story namne

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect powershell command to delete shadow copy using wmic powershell module.
+description: This search is to detect powershell command to delete shadow copy using wmic powershell module.
   This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded
   command to delete shadow copy. This hex encoded command was able to decrypt by powershell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" 
+search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" |
   stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
@@ -21,7 +21,7 @@ references:
 - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
 tags:
   analytic_story:
-  - Ransomware
+  - DarkSide Ransomware
   kill_chain_phases:
   - Exploitation
   mitre_attack_id: