From d78c5bf23de2549541372239e38bcf22fc9abddf Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 12:34:15 -0600
Subject: [PATCH 01/14] Control loading the world

---
 ..._loading_from_world_writable_directory.yml | 75 +++++++++++++++++++
 ...ing_from_world_writable_directory.test.yml | 12 +++
 2 files changed, 87 insertions(+)
 create mode 100644 detections/endpoint/control_loading_from_world_writable_directory.yml
 create mode 100644 tests/endpoint/control_loading_from_world_writable_directory.test.yml

diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml
new file mode 100644
index 0000000000..50d0bfbba9
--- /dev/null
+++ b/detections/endpoint/control_loading_from_world_writable_directory.yml
@@ -0,0 +1,75 @@
+name: Control Loading from World Writable Directory
+id: 10423ac4-10c9-11ec-8dc4-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444.
+  During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `control_loading_from_world_writable_directory_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed.
+references:
+  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+  - https://attack.mitre.org/techniques/T1218/011/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+tags:
+  analytic_story:
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/control_loading_from_world_writable_directory.test.yml b/tests/endpoint/control_loading_from_world_writable_directory.test.yml
new file mode 100644
index 0000000000..0d9e654d60
--- /dev/null
+++ b/tests/endpoint/control_loading_from_world_writable_directory.test.yml
@@ -0,0 +1,12 @@
+name: Control Loading from World Writable Directory Unit Test
+tests:
+- name: Control Loading from World Writable Directory
+  file: endpoint/control_loading_from_world_writable_directory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 4515f473a9bcccdae13bc69fcabf9a672f9ade43 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 12:40:40 -0600
Subject: [PATCH 02/14] Create
 microsoft_mshtml_remote_code_execution_cve_2021_40444.yml

---
 ...l_remote_code_execution_cve_2021_40444.yml | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml

diff --git a/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml b/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
new file mode 100644
index 0000000000..af451f7b7b
--- /dev/null
+++ b/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
@@ -0,0 +1,26 @@
+name: Microsoft MSHTML Remote Code Execution CVE-2021-40444
+id: 4ad4253e-10ca-11ec-8235-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+description: CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents.
+narrative: 'Microsoft is aware of targeted attacks that attempt to exploit this vulnerability, CVE-2021-40444 by using specially-crafted Microsoft Office documents. MSHTML is a software component used to render web pages on Windows. Although it’s most commonly associated with Internet Explorer, it is also used in other software.  CVE-2021-40444 received a CVSS score of 8.8 out of 10. MSHTML is the beating heart of Internet Explorer, the vulnerability also exists in that browser. Although given its limited use, there is little risk of infection by that vector. Microsoft Office applications use the MSHTML component to display web content in Office documents. The attack depends on MSHTML loading a specially crafted ActiveX control when the target opens a malicious Office document. The loaded ActiveX control can then run arbitrary code to infect the system with more malware. \
+  At the moment all supported Windows versions are vulnerable. Since there is no patch available yet, Microsoft proposes a few methods to block these attacks. \
+
+  1. Disable the installation of all ActiveX controls in Internet Explorer via the registry. Previously-installed ActiveX controls will still run, but no new ones will be added, including malicious ones. \
+
+  1. Open documents from the Internet in Protected View or Application Guard for Office, both of which prevent the current attack. This is a default setting but it may have been changed.'
+references:
+  - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://www.echotrail.io/insights/search/control.exe
+tags:
+  analytic_story:
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file

From ef8dbd4927f8825c23c3166203e2a1feb67d5982 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 12:42:53 -0600
Subject: [PATCH 03/14] rundll32 control_rundll32_hunt

---
 .../endpoint/rundll32_control_rundll_hunt.yml | 76 +++++++++++++++++++
 .../rundll32_control_rundll_hunt.test.yml     | 12 +++
 2 files changed, 88 insertions(+)
 create mode 100644 detections/endpoint/rundll32_control_rundll_hunt.yml
 create mode 100644 tests/endpoint/rundll32_control_rundll_hunt.test.yml

diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
new file mode 100644
index 0000000000..5af1736cb1
--- /dev/null
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -0,0 +1,76 @@
+name: Rundll32 Control_RunDLL Hunt
+id: c8e7ced0-10c5-11ec-8b03-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: 'The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444.
+  Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. 
+  This is written to be a bit more broad by not including .cpl.
+  During triage, review parallel processes to identify any further suspicious behavior.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
+  Processes.process=*Control_RunDLL*  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `rundll32_control_rundll_hunt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.
+references:
+  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+  - https://attack.mitre.org/techniques/T1218/011/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+tags:
+  analytic_story:
+  - Suspicious Rundll32 Activity
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/rundll32_control_rundll_hunt.test.yml b/tests/endpoint/rundll32_control_rundll_hunt.test.yml
new file mode 100644
index 0000000000..681110e553
--- /dev/null
+++ b/tests/endpoint/rundll32_control_rundll_hunt.test.yml
@@ -0,0 +1,12 @@
+name: Rundll32 Control_RunDLL Hunt Unit Test
+tests:
+- name: Rundll32 Control_RunDLL Hunt
+  file: endpoint/rundll32_control_rundll_hunt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 6be8f2a4c6ce8ababc72eb904f1fad007fb5d060 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 12:43:28 -0600
Subject: [PATCH 04/14] Update rundll32_control_rundll_hunt.yml

---
 detections/endpoint/rundll32_control_rundll_hunt.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
index 5af1736cb1..2ef4f0705e 100644
--- a/detections/endpoint/rundll32_control_rundll_hunt.yml
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -16,7 +16,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `rundll32_control_rundll_hunt_filter`'
+  | `security_content_ctime(lastTime)` 
+  | `rundll32_control_rundll_hunt_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.
 references:
@@ -24,9 +25,11 @@ references:
   - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
   - https://attack.mitre.org/techniques/T1218/011/
   - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
   dataset: []
   kill_chain_phases:
   - Exploitation

From cc894398a2c9a5142d1443d3fcb08fbf69ce6fde Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 12:49:21 -0600
Subject: [PATCH 05/14] rundll32_control_rundll_world_writable_directory

---
 ...ontrol_rundll_world_writable_directory.yml | 79 +++++++++++++++++++
 ...l_rundll_world_writable_directory.test.yml | 12 +++
 2 files changed, 91 insertions(+)
 create mode 100644 detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
 create mode 100644 tests/endpoint/rundll32_control_rundll_world_writable_directory.test.yml

diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
new file mode 100644
index 0000000000..9609f653ab
--- /dev/null
+++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
@@ -0,0 +1,79 @@
+name: Rundll32 Control_RunDLL World Writable Directory
+id: 1adffe86-10c3-11ec-8ce6-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444.
+  Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. 
+  This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed.
+  During triage, review parallel processes to identify any further suspicious behavior.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
+  Processes.process=*Control_RunDLL* AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*")  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `rundll32_control_rundll_world_writable_directory_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed.  
+references:
+  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+  - https://attack.mitre.org/techniques/T1218/011/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+tags:
+  analytic_story:
+  - Suspicious Rundll32 Activity
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+    - Processes.dest
+    - Processes.user
+    - Processes.parent_process_name #parent process name
+    - Processes.parent_process #parent cmdline
+    - Processes.original_file_name
+    - Processes.process_name #process name
+    - Processes.process #process cmdline
+    - Processes.process_id
+    - Processes.parent_process_path
+    - Processes.process_path
+    - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/rundll32_control_rundll_world_writable_directory.test.yml b/tests/endpoint/rundll32_control_rundll_world_writable_directory.test.yml
new file mode 100644
index 0000000000..8a5cd3b25c
--- /dev/null
+++ b/tests/endpoint/rundll32_control_rundll_world_writable_directory.test.yml
@@ -0,0 +1,12 @@
+name: Rundll32 Control_RunDLL World Writable Directory Unit Test
+tests:
+- name: Rundll32 Control_RunDLL World Writable Directory
+  file: endpoint/rundll32_control_rundll_world_writable_directory.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From b879a26f579801a818d89fddd1ab55d52162893f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-104-197>
Date: Wed, 8 Sep 2021 18:54:50 +0000
Subject: [PATCH 06/14] Added detection testing service results inControl
 Loading from World Writable Directory

---
 ..._loading_from_world_writable_directory.yml | 56 +++++++++++--------
 1 file changed, 33 insertions(+), 23 deletions(-)

diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml
index 50d0bfbba9..1b0b333216 100644
--- a/detections/endpoint/control_loading_from_world_writable_directory.yml
+++ b/detections/endpoint/control_loading_from_world_writable_directory.yml
@@ -6,27 +6,36 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444.
-  During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze.
+description: The following detection identifies control.exe loading either a .cpl
+  or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
+  review parallel processes, parent and child, for further suspicious behaviors. In
+  addition, capture file modifications and analyze.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `control_loading_from_world_writable_directory_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed.
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe
+  OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*",
+  "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives will be present as control.exe does
+  not natively load from writable paths as defined. One may add .cpl or .inf to the
+  command-line if there is any false positives. Tune as needed.
 references:
-  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
-  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-  - https://attack.mitre.org/techniques/T1218/011/
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 tags:
   analytic_story:
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -38,11 +47,11 @@ tags:
   required_fields:
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -50,12 +59,12 @@ tags:
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
   observable:
   - name: user
     type: User
@@ -72,4 +81,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed

From afd99e45aec85c9f50e6bedae2b15a5eb199184a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 12:57:26 -0600
Subject: [PATCH 07/14] fixes

---
 detections/endpoint/rundll32_control_rundll_hunt.yml        | 6 +++---
 .../rundll32_control_rundll_world_writable_directory.yml    | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
index 2ef4f0705e..9103ac3835 100644
--- a/detections/endpoint/rundll32_control_rundll_hunt.yml
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -1,4 +1,4 @@
-name: Rundll32 Control_RunDLL Hunt
+name: Rundll32 Control RunDLL Hunt
 id: c8e7ced0-10c5-11ec-8b03-acde48001122
 version: 1
 date: '2021-09-08'
@@ -7,8 +7,8 @@ type: Hunting
 datamodel:
 - Endpoint
 description: 'The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444.
-  Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. 
-  This is written to be a bit more broad by not including .cpl.
+  Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. \
+  This is written to be a bit more broad by not including .cpl. \
   During triage, review parallel processes to identify any further suspicious behavior.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
index 9609f653ab..ac7a6275ff 100644
--- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
@@ -1,4 +1,4 @@
-name: Rundll32 Control_RunDLL World Writable Directory
+name: Rundll32 Control RunDLL World Writable Directory
 id: 1adffe86-10c3-11ec-8ce6-acde48001122
 version: 1
 date: '2021-09-08'

From ac0f77c28a17f09afaadf3aab3795febb1266770 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-11-252>
Date: Wed, 8 Sep 2021 19:36:28 +0000
Subject: [PATCH 08/14] Added detection testing service results inRundll32
 Control_RunDLL World Writable Directory

---
 ...ontrol_rundll_world_writable_directory.yml | 73 +++++++++++--------
 1 file changed, 42 insertions(+), 31 deletions(-)

diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
index ac7a6275ff..6a67a52d3a 100644
--- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
@@ -6,31 +6,41 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444.
-  Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. 
-  This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed.
-  During triage, review parallel processes to identify any further suspicious behavior.'
+description: The following detection identifies rundll32.exe with `control_rundll`
+  within the command-line, loading a .cpl or another file type from windows\temp,
+  programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can
+  also be used to execute Control Panel Item files (.cpl) through the undocumented
+  shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a
+  .cpl file also causes rundll32.exe to execute. This is written to be a bit more
+  broad by not including .cpl. The paths are specified, add more as needed. During
+  triage, review parallel processes to identify any further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
-  Processes.process=*Control_RunDLL* AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*")  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
+  OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL*
+  AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*")  by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `rundll32_control_rundll_world_writable_directory_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed.  
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: This may be tuned, or a new one related, by adding .cpl to
+  command-line. However, it's important to look for both. Tune/filter as needed.
 references:
-  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
-  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-  - https://attack.mitre.org/techniques/T1218/011/
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -40,26 +50,26 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-    - Processes.dest
-    - Processes.user
-    - Processes.parent_process_name #parent process name
-    - Processes.parent_process #parent cmdline
-    - Processes.original_file_name
-    - Processes.process_name #process name
-    - Processes.process #process cmdline
-    - Processes.process_id
-    - Processes.parent_process_path
-    - Processes.process_path
-    - Processes.parent_process_id
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
   observable:
   - name: user
     type: User
@@ -76,4 +86,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed

From e2640e4a75be336224ce29a4311014698b1638ac Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-11-252>
Date: Wed, 8 Sep 2021 19:37:19 +0000
Subject: [PATCH 09/14] Added detection testing service results inRundll32
 Control_RunDLL Hunt

---
 .../endpoint/rundll32_control_rundll_hunt.yml | 57 +++++++++++--------
 1 file changed, 33 insertions(+), 24 deletions(-)

diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
index 9103ac3835..551807d74a 100644
--- a/detections/endpoint/rundll32_control_rundll_hunt.yml
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -6,31 +6,39 @@ author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: 'The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444.
-  Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. \
-  This is written to be a bit more broad by not including .cpl. \
-  During triage, review parallel processes to identify any further suspicious behavior.'
+description: The following hunting detection identifies rundll32.exe with `control_rundll`
+  within the command-line, loading a .cpl or another file type. Developed in relation
+  to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files
+  (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser.
+  Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written
+  to be a bit more broad by not including .cpl. \ During triage, review parallel processes
+  to identify any further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
-  Processes.process=*Control_RunDLL*  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=rundll32.exe
+  OR Processes.original_file_name=RUNDLL32.EXE) Processes.process=*Control_RunDLL*  by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `rundll32_control_rundll_hunt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: This is a hunting detection, meant to provide a understanding
+  of how voluminous control_rundll is within the environment.
 references:
-  - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
-  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-  - https://attack.mitre.org/techniques/T1218/011/
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -42,11 +50,11 @@ tags:
   required_fields:
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -54,12 +62,12 @@ tags:
   security_domain: endpoint
   impact: 30
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 15
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
   observable:
   - name: user
     type: User
@@ -76,4 +84,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed

From ebac4b065633dc2dc8e182d13830eed975ccc5cb Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 13:57:38 -0600
Subject: [PATCH 10/14] word

---
 .../endpoint/office_spawning_control.yml      | 75 +++++++++++++++++++
 .../endpoint/office_spawning_control.test.yml | 12 +++
 2 files changed, 87 insertions(+)
 create mode 100644 detections/endpoint/office_spawning_control.yml
 create mode 100644 tests/endpoint/office_spawning_control.test.yml

diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml
new file mode 100644
index 0000000000..1e4d5eea82
--- /dev/null
+++ b/detections/endpoint/office_spawning_control.yml
@@ -0,0 +1,75 @@
+name: Office Spawning Control
+id: 053e027c-10c7-11ec-8437-acde48001122
+version: 1
+date: '2021-09-08'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`.
+  In malicious instances, the command-line of `control.exe` will contain a file path to a .cpl or .inf, related to CVE-2021-40444. In this
+  instance, we narrow our detection down to the Office suite as a parent process.
+  During triage, review all file modifications. Capture and analyze any artifacts
+  on disk. review parallel and child processes to identify further suspicious behavior'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=control.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `office_spawning_control_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: Limited false positives should be present. 
+references:
+  - https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html
+  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+  - https://attack.mitre.org/techniques/T1218/011/
+  - https://www.echotrail.io/insights/search/control.exe
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/office_spawning_control.test.yml b/tests/endpoint/office_spawning_control.test.yml
new file mode 100644
index 0000000000..963291c0f1
--- /dev/null
+++ b/tests/endpoint/office_spawning_control.test.yml
@@ -0,0 +1,12 @@
+name: Office Spawning Control Unit Test
+tests:
+- name: Office Spawning Control
+  file: endpoint/office_spawning_control.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_control.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 51690c1335a2a808d43f316a015d555054817431 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-124-84>
Date: Thu, 9 Sep 2021 02:44:46 +0000
Subject: [PATCH 11/14] Added detection testing service results inOffice
 Spawning Control

---
 .../endpoint/office_spawning_control.yml      | 50 +++++++++++--------
 1 file changed, 29 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml
index 1e4d5eea82..1be007cb72 100644
--- a/detections/endpoint/office_spawning_control.yml
+++ b/detections/endpoint/office_spawning_control.yml
@@ -6,31 +6,38 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`.
-  In malicious instances, the command-line of `control.exe` will contain a file path to a .cpl or .inf, related to CVE-2021-40444. In this
-  instance, we narrow our detection down to the Office suite as a parent process.
-  During triage, review all file modifications. Capture and analyze any artifacts
-  on disk. review parallel and child processes to identify further suspicious behavior'
+description: The following detection identifies control.exe spawning from an office
+  product. This detection identifies any Windows Office Product spawning `control.exe`.
+  In malicious instances, the command-line of `control.exe` will contain a file path
+  to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection
+  down to the Office suite as a parent process. During triage, review all file modifications.
+  Capture and analyze any artifacts on disk. review parallel and child processes to
+  identify further suspicious behavior
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=control.exe
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `office_spawning_control_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: Limited false positives should be present. 
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives should be present.
 references:
-  - https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html
-  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-  - https://attack.mitre.org/techniques/T1218/011/
-  - https://www.echotrail.io/insights/search/control.exe
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://www.echotrail.io/insights/search/control.exe
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 tags:
   analytic_story:
   - Spearphishing Attachments
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -42,11 +49,11 @@ tags:
   required_fields:
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -54,12 +61,12 @@ tags:
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ clicking a suspicious attachment.
   observable:
   - name: dest
     type: Hostname
@@ -72,4 +79,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed

From 317f25ff452010e96544db8ee3d82fc0ab3d4529 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 9 Sep 2021 10:10:58 -0600
Subject: [PATCH 12/14] Update office_spawning_control.yml

---
 detections/endpoint/office_spawning_control.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml
index 1be007cb72..b15d120c14 100644
--- a/detections/endpoint/office_spawning_control.yml
+++ b/detections/endpoint/office_spawning_control.yml
@@ -15,7 +15,7 @@ description: The following detection identifies control.exe spawning from an off
   identify further suspicious behavior
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=control.exe
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") Processes.process_name=control.exe
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `office_spawning_control_filter`'

From 8936651b407629d28596d8fdf7806eb80a0c9bfc Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 9 Sep 2021 10:53:47 -0600
Subject: [PATCH 13/14] mshtml_module_load_in_office_product

---
 .../mshtml_module_load_in_office_product.yml  | 69 +++++++++++++++++++
 ...tml_module_load_in_office_product.test.yml | 12 ++++
 2 files changed, 81 insertions(+)
 create mode 100644 detections/endpoint/mshtml_module_load_in_office_product.yml
 create mode 100644 tests/endpoint/mshtml_module_load_in_office_product.test.yml

diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml
new file mode 100644
index 0000000000..826ed5f7a1
--- /dev/null
+++ b/detections/endpoint/mshtml_module_load_in_office_product.yml
@@ -0,0 +1,69 @@
+name: MSHTML Module Load in Office Product
+id: 5f1c168e-118b-11ec-84ff-acde48001122
+version: 1
+date: '2021-09-09'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component.
+  During triage, identify parallel processes and capture any file modifications for analysis.
+search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer,
+  process_name, ImageLoaded, OriginalFileName, process_id 
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `mshtml_module_load_in_office_product_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process names and image loads from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: Limited false positives will be present, however, tune as necessary.
+references:
+  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+  - https://strontic.github.io/xcyclopedia/index-dll
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - Microsoft MSHTML Remote Code Execution CVE-2021-40444
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ImageLoaded
+  - process_name
+  - OriginalFileName
+  - process_id
+  - dest
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $process_name$ was identified
+    on endpoint $dest$ loading mshtml.dll. 
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed
diff --git a/tests/endpoint/mshtml_module_load_in_office_product.test.yml b/tests/endpoint/mshtml_module_load_in_office_product.test.yml
new file mode 100644
index 0000000000..e6252f9fe9
--- /dev/null
+++ b/tests/endpoint/mshtml_module_load_in_office_product.test.yml
@@ -0,0 +1,12 @@
+name: MSHTML Module Load in Office Product Unit Test
+tests:
+- name: MSHTML Module Load in Office Product
+  file: endpoint/mshtml_module_load_in_office_product.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_mshtml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From d86a4debf5d7078a9a6b01babaceb2daee44a06a Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-251-104>
Date: Thu, 9 Sep 2021 18:02:13 +0000
Subject: [PATCH 14/14] Added detection testing service results inMSHTML Module
 Load in Office Product

---
 .../mshtml_module_load_in_office_product.yml  | 37 ++++++++++---------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml
index 826ed5f7a1..05b3cdb1f4 100644
--- a/detections/endpoint/mshtml_module_load_in_office_product.yml
+++ b/detections/endpoint/mshtml_module_load_in_office_product.yml
@@ -6,29 +6,30 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component.
-  During triage, identify parallel processes and capture any file modifications for analysis.
-search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer,
-  process_name, ImageLoaded, OriginalFileName, process_id 
-  | rename Computer as dest 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `mshtml_module_load_in_office_product_filter`'
+description: The following detection identifies the module load of mshtml.dll into
+  an Office product. This behavior has been related to CVE-2021-40444, whereas the
+  malicious document will load ActiveX, which activates the MSHTML component. The
+  vulnerability resides in the MSHTML component. During triage, identify parallel
+  processes and capture any file modifications for analysis.
+search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
+  ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
+  ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process names and image loads from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  logs with the process names and image loads from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Limited false positives will be present, however, tune as necessary.
 references:
-  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-  - https://strontic.github.io/xcyclopedia/index-dll
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://strontic.github.io/xcyclopedia/index-dll
 tags:
   analytic_story:
   - Spearphishing Attachments
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -51,8 +52,8 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $process_name$ was identified
-    on endpoint $dest$ loading mshtml.dll. 
+  message: An instance of $process_name$ was identified on endpoint $dest$ loading
+    mshtml.dll.
   observable:
   - name: dest
     type: Hostname