Merge branch 'develop' into test_curl

bin/jinja2_templates/doc_playbooks.j2

@@ -39,7 +39,7 @@ tags:
 {{ playbook.how_to_implement}}
 
 #### Playbooks
-![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.name | lower | replace(" ", "_")}}.png)
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.playbook | lower | replace(" ", "_")}}.png)
 
 #### Required field
 {% for field in playbook.tags.playbook_fields -%}
@@ -54,4 +54,4 @@ tags:
 {% endif %}
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}**
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.playbook | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}**

bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py

@@ -429,7 +429,7 @@ class DSPApi:
         return preview_id
 
 
-    def ingest_data(self, data):
+    def ingest_data(self, data, sourcetype):
         """
         Send events
 
@@ -443,9 +443,11 @@ class DSPApi:
         response
             response body in JSON format
         """
+        if sourcetype == "WinEventLog:Security":
+            sourcetype = "WinEventLog"
         data = [{
             "body": event,
-            "sourcetype": "WinEventLog"
+            "sourcetype": sourcetype
             } for event in data]
         response = requests.post(self.return_api_endpoint(INGEST_ENDPOINT), json=data, headers=request_headers(self.header_token))
         if response.status_code != HTTPStatus.OK:

bin/ssa-end-to-end-testing/modules/test_ssa_detections.py

@@ -1,5 +1,6 @@
 import logging
 import os
+from re import S
 import time
 import sys
 import uuid
@@ -48,7 +49,7 @@ class SSADetectionTesting:
         for i in range(0, len(test_spls)):
             self.max_execution_time = MAX_EXECUTION_TIME_LIMIT
             test_id = str(uuid.uuid4())
-            test_result = self.ssa_detection_test(read_spl(file_path_spl, test_spls[i]), file_path_data, test_names[i], test_id)
+            test_result = self.ssa_detection_test(read_spl(file_path_spl, test_spls[i]), file_path_data, test_names[i], test_id, "WinEventLog")
             test_results.append(test_result.copy())
 
         passed = True
@@ -70,6 +71,7 @@ class SSADetectionTesting:
         test_id = str(uuid.uuid4())
         test_results = self.ssa_detection_test(test_obj["detection_obj"]["search"], file_path_attack_data,
                                                "SSA Smoke Test " + test_obj["test_obj"]["name"], test_id,
+                                               test_obj['test_obj']['tests'][0]['attack_data'][0]['source'],
                                                test_obj['test_obj']['tests'][0]['pass_condition'])
 
         return test_results
@@ -113,7 +115,7 @@ class SSADetectionTesting:
                 else:
                     LOGGER.warning("Found and deleted an old pipeline: %s", pipeline['name'])
 
-    def ssa_detection_test_main(self, spl, source, test_name, pass_condition, test_id):
+    def ssa_detection_test_main(self, spl, source, test_name, pass_condition, test_id, sourcetype):
         self.execution_passed = True
 
         self.wait_time(SLEEP_TIME_CREATE_INDEX)
@@ -147,12 +149,12 @@ class SSADetectionTesting:
             self.test_results["msg"] = msg
             return self.test_results
 
-        data = read_data(source)
+        data = read_data(source, sourcetype)
         LOGGER.info("Sending (%d) events" % (len(data)))
 
         assert len(data) > 0, "No events to send, skip to next test."
 
-        data_uploaded = self.api.ingest_data(data)
+        data_uploaded = self.api.ingest_data(data, sourcetype)
         assert data_uploaded, "Failed to upload test data"
 
         self.wait_time(SLEEP_TIME_SEND_DATA)
@@ -212,10 +214,10 @@ class SSADetectionTesting:
         else:
             LOGGER.info("Testing successfully cleaned up")
 
-    def ssa_detection_test(self, spl, source, test_name, test_id, pass_condition='@count_gt(0)'):
+    def ssa_detection_test(self, spl, source, test_name, test_id, sourcetype, pass_condition='@count_gt(0)'):
         self.ssa_detection_test_init()
         try:
-            test_result = self.ssa_detection_test_main(spl, source, test_name, pass_condition, test_id)
+            test_result = self.ssa_detection_test_main(spl, source, test_name, pass_condition, test_id, sourcetype)
             self.ssa_detection_test_teardown()
             return test_result
         except AssertionError as e:

bin/ssa-end-to-end-testing/modules/utils.py

@@ -3,6 +3,7 @@ import logging
 import os
 import fileinput
 import re
+import io
 
 from .data_manipulation import DataManipulation
 
@@ -104,31 +105,35 @@ def replace_ssa_macros(source, sink, spl):
     return spl
 
 
-def read_data(file_path):
-    data_manipulation = DataManipulation()
-    modified_file = data_manipulation.manipulate_timestamp(file_path, 'xmlwineventlog', 'WinEventLog:Security')
+def read_data(file_path, sourcetype):
     data = []
-    date_rex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M'
-    count = len(open(modified_file).readlines())
+    if sourcetype == "WinEventLog:Security" or sourcetype == "WinEventLog":
+        data_manipulation = DataManipulation()
+        modified_file = data_manipulation.manipulate_timestamp(file_path, 'xmlwineventlog', 'WinEventLog:Security')
+        date_rex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M'
+        count = len(open(modified_file).readlines())
 
-    i = 0
-    file = fileinput.input(files=modified_file)
-    event = file[0]
-    start_position = 0
+        i = 0
+        file = fileinput.input(files=modified_file)
+        event = file[0]
+        start_position = 0
 
-    for i in range(1, count):
-        line = file[i]
-        i = i + 1
-        if re.match(date_rex, line):
-            data.append(event)
-            start_position = i
-            event = line
-        else:
-            event = event + line
+        for i in range(1, count):
+            line = file[i]
+            i = i + 1
+            if re.match(date_rex, line):
+                data.append(event)
+                start_position = i
+                event = line
+            else:
+                event = event + line
 
 
-    data.append(event)
-    fileinput.close()
+        data.append(event)
+        fileinput.close()
+    elif sourcetype == "xmlwineventlog":
+        for line in fileinput.input(files=file_path):
+            data.append(line)
 
     return data
 

detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml

@@ -1,30 +1,35 @@
 name: Applying Stolen Credentials via Mimikatz modules
 id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
-  attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
+  - Endpoint_Processes
+description: 'The following analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket, Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior is typically performed within interactive Mimikatz memory space, however it may be identified on the command-line.
+  A Pass-the-Ticket (ptt) attack is performed once an adversary has established access to a single endpoint and retrieved the kerberos ticket to now begin moving laterally using this method. Typically, it blends in with logon activity as the ticket can be copied to another system and passed into the current session effectively simulating a logon without any communication with the Domain Controller.
+  A Golden or Silver ticket attack requires some setup by the adversary, but once performed it will simulate lateral based authentication to additional endpoints.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
   /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
   OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
-
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to Mimikatz.
 references:
-- https://github.com/gentilkiwi/mimikatz
-- https://adsecurity.org/?p=1275
+  - https://github.com/gentilkiwi/mimikatz
+  - https://adsecurity.org/?p=1275
+  - https://adsecurity.org/?p=1515
+  - https://adsecurity.org/?page_id=1821#KERBEROSPTT
+  - https://attack.mitre.org/software/S0002/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash
 tags:
   analytic_story:
   - Credential Dumping
@@ -58,6 +63,10 @@ tags:
   - T1554
   - T1556
   - T1558
+  - T1558.002
+  - T1558.001
+  - T1003
+  - T1003.001
   nist:
   - PR.AC
   - PR.IP
@@ -81,6 +90,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint

detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml

@@ -1,15 +1,13 @@
 name: Applying Stolen Credentials via PowerSploit modules
 id: 270b482d-2af2-448f-9923-9cf005f61be4
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Stolen credentials are applied by methods such as user impersonation,
-  credential injection, spoofing of authentication processes or getting hold of critical
-  accounts. This detection indicates such activities carried out by PowerSploit exploit
-  kit APIs.
+  - Endpoint_Processes
+description: 'The following analytic identifies commonly used PowerSploit modules that perform credential access, spoofing of authentication processes, user impersonation and attempting to manipulate tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`, `Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied as modules used to access credentials.
+  PowerSploit is an archived project on GitHub, but much of its modules and scripts are still utilized today by adversaries. This behavior is typically performed within interactive PowerShell sessions or injected into processes, however it may be identified on the command-line.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -24,11 +22,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to PowerSploit.
 references:
-- https://github.com/PowerShellMafia/PowerSploit
+  - https://github.com/PowerShellMafia/PowerSploit
+  - https://attack.mitre.org/software/S0194/
 tags:
   analytic_story:
   - Credential Dumping
@@ -62,6 +62,7 @@ tags:
   - T1554
   - T1555
   - T1558
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -85,6 +86,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
   security_domain: endpoint

detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml

@@ -1,13 +1,12 @@
 name: Assessment of Credential Strength via DSInternals modules
 id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection identifies use of DSInternals modules that verify password
-  strength, i.e., identify weak accounts that would be easily compromised.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that verifies password strength. Adversaries have utilized this module to determine password complexity or to identify accounts with weak passwords.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -19,11 +18,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -49,6 +50,8 @@ tags:
   - T1201
   - T1552
   - T1555
+  - T1059.001
+  - T1059
   nist:
   - PR.AC
   - PR.IP
@@ -72,6 +75,7 @@ tags:
   - process
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 25
   risk_severity: high
   security_domain: endpoint

detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml

@@ -1,16 +1,14 @@
 name: Credential Extraction indicative of use of DSInternals credential conversion
   modules
 id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+  - Endpoint_Processes
+description: 'The following analytic identifies modules within DSInternals that are used for extracting credentials from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`, `ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`, `ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`.
+  Adversaries may use these modules for decrypting or transforming the stored credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -30,11 +28,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -53,10 +54,12 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   message: DSInternals tool kit is converting stolen credential material to a form
-    applicable to authentications. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+    applicable to authentications. Operation is performed on the device $dest_device_id$,
+    by the account $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -69,10 +72,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -82,7 +85,7 @@ tags:
   - _time
   - process_path
   - dest_user_id
-  - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint

detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml

@@ -1,15 +1,13 @@
 name: Credential Extraction indicative of use of DSInternals modules
 id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies modules of DSInternals being used on the associated endpoint.
+  Adversaries may use these modules for manipulating data related to Active Directory and credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -31,11 +29,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -56,9 +57,11 @@ tags:
   message: DSInternals tool kit is accessing sensitive credential material such as
     KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
     Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -71,10 +74,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,6 +88,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint

detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml

@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with s option
 id: 312582f2-5e91-42c1-a275-cd67f31373c8
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-s` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -28,10 +24,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
-references: []
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 tags:
   analytic_story:
   - Unusual Processes
@@ -51,9 +53,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -66,10 +69,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -80,6 +83,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint

detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml

@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with v option
 id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-v` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -26,9 +22,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 references: []
 tags:
   analytic_story:
@@ -49,9 +52,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -64,10 +68,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -77,6 +81,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: high
   security_domain: endpoint

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -19,7 +19,7 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -36,7 +36,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_renamed_psexec.yml

@@ -33,7 +33,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 90
   context:

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies executable files (.exe or .dll) being
   written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
-  suspicious behavior as its commonly user by tools like like PsExec/PaExec and others
+  suspicious behavior as its commonly used by tools like like PsExec/PaExec and others
   to stage service binaries before creating and starting a Windows service on remote
   endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
   movement and remote code execution. The Trickbot malware family also implements
@@ -31,7 +31,7 @@ references:
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - Trickbot
   automated_detection_testing: passed
   confidence: 100

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -36,7 +36,7 @@ references:
 - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/investigate_successful_remote_desktop_authentications.yml

@@ -23,7 +23,7 @@ references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - SamSam Ransomware
   product:
   - Splunk Phantom

detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml

@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/net_localgroup_discovery.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Windows Discovery Techniques
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/possible_lateral_movement_powershell_spawn.yml

@@ -0,0 +1,86 @@
+name: Possible Lateral Movement PowerShell Spawn
+id: cb909b3e-512b-11ec-aa31-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic assists with identifying a PowerShell process
+  spawned as a child or grand child process of commonly abused processes during lateral
+  movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe`
+  and `mmc.exe`. Legitimate Windows features such as the Service Control Manager,
+  Windows Management Instrumentation, Task Scheduler, Windows Remote Management and
+  the DCOM protocol can be abused to start a process on a remote endpoint. Looking
+  for PowerShell spawned out of this processes may reveal a lateral movement attack.
+  Red Teams and adversaries alike may abuse these services during a breach for lateral
+  movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe
+  OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe
+  OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe)
+  (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*)
+  OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may spawn PowerShell as a child process
+  of the the identified processes. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1021/003
+- https://attack.mitre.org/techniques/T1021/006/
+- https://attack.mitre.org/techniques/T1047/
+- https://attack.mitre.org/techniques/T1053.005/
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Malicious PowerShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  - Malicious PowerShell
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  - T1021.006
+  - T1047
+  - T1053.005
+  - T1543.003
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A PowerShell process was spawned as a child process of typically abused
+    processes on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml

@@ -27,7 +27,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml

@@ -25,7 +25,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml

@@ -28,7 +28,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml

@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml

@@ -27,7 +27,7 @@ references:
 - https://attack.mitre.org/techniques/T1021/006/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -30,7 +30,7 @@ tags:
   analytic_story:
   - Ransomware
   - Suspicious WMI Use
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml

@@ -27,7 +27,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml

@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:

detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml

@@ -29,7 +29,7 @@ references:
 - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1053/005/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -27,7 +27,7 @@ known_false_positives: Administrators may create scheduled tasks on remote syste
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed

detections/endpoint/services_exe_lolbas_execution_process_spawn.yml

@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `services.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Service Control
   Manager and creating a remote malicious service, the executed command is spawned
-  as a child processs of `services.exe`. The LOLBAS project documents Windows native
+  as a child process of `services.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of services.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/short_lived_scheduled_task.yml

@@ -0,0 +1,67 @@
+name: Short Lived Scheduled Task
+id: 6fa31414-546e-11ec-adfa-acde48001122
+version: 1
+date: '2021-12-03'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic leverages Windows Security EventCode 4698, `A
+  scheduled task was created` and Windows Security EventCode 4699, `A scheduled task
+  was deleted` to identify scheduled tasks created and deleted in less than 30 seconds.
+  This behavior may represent a lateral movement attack abusing the Task Scheduler
+  to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler
+  for lateral movement and remote code execution.
+search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message
+  | transaction Task_Name  startswith=(EventCode=4698) endswith=(EventCode=4699) |
+  eval short_lived=case((duration<30),"TRUE") | search  short_lived = TRUE | table
+  _time, ComputerName, Account_Name, Command, Task_Name, short_lived | `short_lived_scheduled_task_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: Although uncommon, legitimate applications may create and delete
+  a Scheduled Task within 30 seconds. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - ComputerName
+  - Account_Name
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  impact: 90
+  confidence: 90
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Lateral Movement
+  message: A windows scheduled task was created and deleted in 30 seconds on $ComputerName$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Command
+    type: Command
+    role:
+    - Target
+  automated_detection_testing: passed

detections/endpoint/ssa___attempt_to_delete_services.yml

@@ -1,16 +1,13 @@
 name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to delete a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then delete it.
-  Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,11 +23,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
 tags:
   analytic_story:
   - XMRig
@@ -52,6 +49,8 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
   mitre_attack_id:
   - T1489
+  - T1543
+  - T1543.003
   nist:
   - PR.DS
   - PR.IP
@@ -85,4 +84,4 @@ tags:
   - cmd_line
   risk_score: 36
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/ssa___attempt_to_disable_services.yml

@@ -1,16 +1,13 @@
 name: Attempt To Disable Services
 id: afb31de4-d023-11eb-98d5-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to disable a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then disable
-  it. Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
   "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,13 +24,12 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
 tags:
   analytic_story:
   - XMRig
@@ -87,4 +83,4 @@ tags:
   - process
   risk_score: 36
   risk_severity: medium
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -1,13 +1,12 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: 14038953-e5f2-4daf-acff-5452062baf03
-version: 1
-date: 2020-6-04
+version: 2
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Monitor for execution of reg.exe with parameters specifying an export
-  of keys that contain hashed credentials that attackers may try to crack offline.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking.'
 search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
   "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
@@ -22,11 +21,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
   body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events(); '
-how_to_implement: You must be ingesting windows endpoint data that tracks process
-  activity, including parent-child relationships from your endpoints.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
 known_false_positives: None identified.
 references:
-- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   analytic_story:
   - Credential Dumping
@@ -43,11 +45,10 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping stored credentials from the registry sections
-    SAM, Security, or System. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+  message: An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - DE.CM
   observable:
@@ -59,10 +60,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -71,6 +72,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml

@@ -0,0 +1,84 @@
+name: BCDEdit Failure Recovery Modification
+id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to bcdedit.exe modifications to the
+  built-in Windows error recovery boot configurations. This is typically used by ransomware
+  to prevent recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" AND
+  (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the
+    endpoint.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint

detections/endpoint/ssa___delete_a_net_user.yml

@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -18,14 +18,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%")
-  AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
-  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
-  "parent_process_name", parent_process_name, "process_path", process_path]) | into
-  write_ssa_detected_events();'
-how_to_implement: o successfully implement this search, you need to be ingesting logs
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
   with the process name, parent process, and command-line executions from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
   Tune and filter known instances where renamed net.exe may be used.

detections/endpoint/ssa___deny_permission_using_cacls_utility.yml

@@ -1,15 +1,12 @@
 name: Deny Permission using Cacls Utility
 id: b76eae28-cd25-11eb-9c92-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-29'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies a potential adversary that changes the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
-  and prevent access to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint

detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml

@@ -1,29 +1,29 @@
 name: Detect Dump LSASS Memory using comsvcs
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
 version: 2
-date: '2020-09-15'
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: This search detects the memory of lsass.exe being dumped for offline
-  credential theft attack.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
-  | eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
-  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
-  timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event,
-  "process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string",
-  null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
-  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id)
-  | eval body=create_map(["event_id", event_id, "process_name", process_name, "process",
-  process]) | into write_ssa_detected_events();'
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies credential dumping using comsvcs.dll with `regsvr32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe and perform offline password cracking.'
+search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
+  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
+  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
+  timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
+  "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
   Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
   on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
-known_false_positives: None identified.
+known_false_positives: False positives should be limited, filter as needed.
 references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
 tags:
   analytic_story:
   - Credential Dumping
@@ -41,9 +41,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc
-    DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+  message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$.
   mitre_attack_id:
   - T1003.003
   - T1003
@@ -58,10 +56,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
-    role:
-    - Others
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -72,4 +66,4 @@ tags:
   - process
   risk_score: 70
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/ssa___detect_rclone_command_line_usage.yml

@@ -0,0 +1,90 @@
+name: Detect RClone Command-Line Usage
+id: e8b74268-5454-11ec-a799-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This analytic identifies commonly used command-line arguments used by
+  `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
+  specific to the configuration used by adversaries. In particular, an adversary may
+  list the files or directories of the remote file share using `ls` or `lsd`, which
+  is not indicative of malicious behavior. During triage, at this stage of a ransomware
+  event, exfiltration is about to occur or has already. Isolate the endpoint and continue
+  investigating by review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND
+  (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
+  OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%")
+  OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%")
+  OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives should be limited as this is restricted to
+  the Rclone process name. Filter or tune the analytic as needed.
+references:
+  - https://redcanary.com/blog/rclone-mega-extortion/
+  - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+  - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
+tags:
+  analytic_story:
+  - DarkSide Ransomware
+  - Ransomware
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service
+    to move files or folders.
+  mitre_attack_id:
+  - T1020
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint

detections/endpoint/ssa___disable_net_user_account.yml

@@ -1,15 +1,14 @@
 name: Disable Net User Account
 id: ba858b08-d26c-11eb-af9b-acde48001122
 version: 3
-date: '2021-12-01'
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will identify a suspicious command-line that disables a
-  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
-  may used by the adversaries to interrupt availability of accounts and continue the
-  impact against the organization.
+  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
+  by the adversaries to interrupt availability of accounts and continue the impact against the organization.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -28,8 +27,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
   used.
-known_false_positives: System administrators or automated scripts may disable an account
-  but not a common practice. Filter as needed.
+known_false_positives: System administrators or automated scripts may disable an
+  account but not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -52,6 +51,7 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
   mitre_attack_id:
   - T1489
+  - T1078
   nist:
   - PR.AC
   - PR.IP
@@ -83,6 +83,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 49
   risk_severity: medium
-  security_domain: endpoint
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml

@@ -0,0 +1,86 @@
+name: DNS Exfiltration Using Nslookup App
+id: 2452e632-9e0d-11eb-34ba-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect potential DNS exfiltration using nslookup application.
+  This technique are seen in couple of malware and APT group to exfiltrated collected
+  data in a infected machine or infected network. This detection is looking for unique
+  use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
+  commonly used by attacker and also the retry parameter which is designed to query
+  C2 DNS multiple tries.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" AND
+  (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, "%-q=%")
+  OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed.
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+tags:
+  analytic_story:
+  - Suspicious DNS Traffic
+  - Dynamic DNS
+  - Command and Control
+  - Data Exfiltration
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration.
+  mitre_attack_id:
+  - T1048
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint

detections/endpoint/ssa___excessive_number_of_office_files_copied.yml

@@ -0,0 +1,54 @@
+name: Excessive Number of Office Files Copied
+id: 3c6594a9-8df6-45a1-9357-d73b62083c63
+version: 1
+date: '2021-12-07'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Filesystem
+description: This detection detects a high amount of office file copied.
+  This can be an indicator for a malicious insider.
+search: '| from read_ssa_enriched_events() 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
+  | eval action=ucast(map_get(input_event, "action"), "string", null), 
+  process=ucast(map_get(input_event, "process"), "string", null), 
+  file_name=ucast(map_get(input_event, "file_name"), "string", null), 
+  file_path=ucast(map_get(input_event, "file_path"), "string", null), 
+  dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) 
+  | where "Endpoint_Filesystem" IN(_datamodels) 
+  | where action="created" 
+  | where like(file_name, "%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") 
+  | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp, 10m)
+  | where count > 20
+  | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, dest_device_id), body=create_map(["count", count]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
+known_false_positives: user may copy a lot of office fies from one folder to another
+references: []
+tags:
+  analytic_story: []
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Exfitration
+  dataset:
+   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: High number of files copied
+  mitre_attack_id:
+  - T1048.003
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - action
+  - process
+  - file_name
+  - file_path
+  risk_score: 72
+  security_domain: endpoint
+

detections/endpoint/ssa___first_time_seen_cmd_line.yml

@@ -1,14 +1,15 @@
 name: First time seen command line argument
 id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
-version: 3
-date: 2021-2-1
+version: 4
+date: '2021-11-30'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This search looks for command-line arguments that use a `/c` parameter
   to execute a command that has not previously been seen. This is an implementation
   on SPL2 of the rule `First time seen command line argument` by @bpatel.
+  'The following analytic identifies first time seen command-line arguments on a single endpoint. The analytic looks for arguments instantiated by `cmd.exe /c` and the associated command-line. Adversaries automate or spawn multiple processes using this method, this analytic may assist with identifying the first time it's been found on this endpoint.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
   "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
@@ -26,12 +27,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
   dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be populating the endpoint data model for SSA and specifically
-  the process_name and the process fields
-known_false_positives: Legitimate programs can also use command-line arguments to
-  execute. Please verify the command-line arguments to check what command/program
-  is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
-  macro to exclude legitimate parent_process_name
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Legitimate programs use command-line arguments to
+  execute. Verify the command-line arguments to check what command/program
+  is being executed. Filtering will be needed.
 references: []
 tags:
   analytic_story:
@@ -47,11 +49,9 @@ tags:
   kill_chain_phases:
   - Command and Control
   - Actions on Objectives
-  message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
-    command has not previously seen in host $dest_device_id$
+  message: A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$
   mitre_attack_id:
   - T1059
-  - T1117
   - T1202
   nist:
   - PR.PT
@@ -74,6 +74,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 30
   risk_severity: low
   security_domain: endpoint

detections/endpoint/ssa___fsutil_zeroing_file.yml

@@ -0,0 +1,83 @@
+name: Fsutil Zeroing File
+id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect a suspicious fsutil process to zeroing a target
+  file. This technique was seen in lockbit ransomware where it tries to zero out its
+  malware path as part of its defense evasion after encrypting the compromised host.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" AND
+  (like (cmd_line, "%setzerodata%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed net.exe may be used.
+known_false_positives: System administrators or scripts may delete user accounts via
+  this technique. Filter as needed.
+references:
+  - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
+tags:
+  analytic_story:
+  - Ransomware
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion.
+  mitre_attack_id:
+  - T1070
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 54
+  risk_severity: high
+  security_domain: endpoint

detections/endpoint/ssa___grant_permission_using_cacls_utility.yml

@@ -1,15 +1,12 @@
 name: Grant Permission Using Cacls Utility
 id: c6da561a-cd29-11eb-ae65-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies potential adversaries that modify the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware and coinminer scripts to evade detections and restrict access
-  to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint

detections/endpoint/ssa___high_file_deletion_frequency.yml

@@ -0,0 +1,75 @@
+name: High File Deletion Frequency
+id: b6200efd-13bd-4336-920a-057b25bbcfaf
+version: 1
+date: '2021-12-07'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Filesystem
+description: This detection detects a high amount of file deletions in a short time for specific file types.
+  This can be an indicator for a malicious insider.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
+  | eval action=ucast(map_get(input_event, "action"), "string", null), 
+  process=ucast(map_get(input_event, "process"), "string", null), 
+  file_name=ucast(map_get(input_event, "file_name"), "string", null), 
+  file_path=ucast(map_get(input_event, "file_path"), "string", null), 
+  dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) 
+  | where "Endpoint_Filesystem" IN(_datamodels) 
+  | where action="deleted" 
+  | where like(file_name, "%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") 
+  OR like(file_name, "%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") 
+  OR like(file_name, "%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") 
+  OR like(file_name, "%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") 
+  OR like(file_name, "%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") 
+  OR like(file_name, "%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") 
+  OR like(file_name, "%.js")
+  | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) 
+  | where count > 20
+  | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, dest_device_id), body=create_map(["count", count]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
+known_false_positives: user may delete bunch of pictures or files in a folder.
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+tags:
+  analytic_story:
+  - Clop Ransomware
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: High frequency file deletion activity detected on host $Computer$
+  mitre_attack_id:
+  - T1485
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: deleted_files
+    type: File Name
+    role:
+    - Target
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - action
+  - process
+  - file_name
+  - file_path
+  risk_score: 72
+  security_domain: endpoint
+

detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -1,7 +1,7 @@
 name: Modify ACLs Permission Of Files Or Folders
 id: 9ae9a48a-cdbe-11eb-875a-acde48001122
-version: 1
-date: '2021-06-15'
+version: 2
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic identifies suspicious modification of ACL permission
   a files or folder to make it available to everyone or to a specific user. This technique
   may be used by the adversary to evade ACLs or protected files access. This changes
   is commonly configured by the file or directory owner with appropriate permission.
-  This behavior is a good indicator if this command seen on a machine utilized by
+  This behavior raises suspicion if this command is seen on an endpoint utilized by
   an account with no permission to do so.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
@@ -29,7 +29,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
-known_false_positives: network administrator may use this windows utility. filter
+known_false_positives: System administrators may use this windows utility. filter
   is needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -74,6 +74,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint

detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml

@@ -4,15 +4,11 @@ version: 2
 date: '2020-11-10'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel:
-- Endpoint_Processes
-description: The following analytic identifies parent processes, browsers, Windows
-  terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
-  many applications spawn cmd.exe natively or built into macros. Much of this will
-  need to be tuned to further enhance the risk. During triage, review parallel process
-  execution and identify any file modifications that may have occurred. Capture any
-  artifacts and review further.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.'
+search: '| from read_ssa_enriched_events()
+
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -82,6 +78,7 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 35
   risk_severity: low
   security_domain: endpoint

detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml

@@ -1,13 +1,13 @@
 name: Potential Pass the Token or Hash Observed at the Destination Device
 id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
-version: 2
-date: '2021-11-05'
+version: 3
+date: '2021-11-30'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by a detination device.
 search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
@@ -45,10 +45,11 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml

@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by an event-collecting device (i.e., a specific domain controller or an endpoint
   destination).
@@ -47,10 +47,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml

@@ -1,13 +1,13 @@
 name: Rare Parent-Child Process Relationship
 id: cf090c78-bcc6-11eb-8529-0242ac130003
-version: 1
-date: '2021-05-20'
+version: 2
+date: '2021-11-30'
 author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
 - Endpoint_Processes
 description: An attacker may use LOLBAS tools spawned from vulnerable applications
-  not typically used by system administrators. This search leverages the Splunk Streaming
+  not typically used by system administrators. This analytic leverages the Splunk Streaming
   ML DSP plugin to find rare parent/child relationships. The list of application has
   been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
@@ -52,12 +52,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
   cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
-known_false_positives: 'Some custom tools used by admins could be used rarely to launch
+known_false_positives: 'Some custom tools used by administrators could be used rarely to launch
   remotely applications. This might trigger false positives at the beginning when
-  it hasn''t collected yet enough data to construct the baseline.
-
-  '
-references: []
+  it has not collected yet enough data to construct the baseline.'
+references: 
+  - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 tags:
   analytic_story:
   - Unusual Processes
@@ -82,5 +81,6 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_severity: low
   security_domain: endpoint

detections/endpoint/ssa___resize_shadowstorage_volume.yml

@@ -1,17 +1,13 @@
 name: Resize Shadowstorage Volume
 id: dbc30554-d27e-11eb-9e5e-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint_Processes
-description: The following analytics identifies the resizing of shadowstorage by ransomware
-  malware to avoid the shadow volumes being made again. this technique is an alternative
-  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
-  team. one example of ransomware that use this technique is CLOP ransomware where
-  it drops a .bat file that will resize the shadowstorage to minimum size as much
-  as possible
+description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
+  and a precursor to deleting the shadowstorage. 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,8 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: System administrators may resize the shadowstorage for valid
-  purposes. Filter as needed.
+known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -88,4 +83,4 @@ tags:
   - cmd_line
   risk_score: 64
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/ssa___sdelete_application_execution.yml

@@ -5,34 +5,30 @@ date: '2021-11-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
-description: This analytic will detect the execution of sdelete.exe attempting to
-  delete potentially important files that may related to adversary or insider threats
-  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
-  to securely delete files on disk. This tool is commonly used to clear tracks and
-  artifact on the targeted host.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
-  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
-  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
-  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
-  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
-  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
-  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
-  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
-  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
-  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
-  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
-  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
-  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
-  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
-  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
+  - Endpoint_Processes
+description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files 
+  that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
+  meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
+search: '| from read_ssa_enriched_events()
+  | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), 
+  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), 
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), 
+  parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), 
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") 
+  AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %")
+  OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") 
+  OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") 
+  OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") 
+  OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") 
+  OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") 
+  OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") 
+  OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) 
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -52,27 +48,32 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
   impact: 60
+  risk_score: 42
   kill_chain_phases:
   - Exploitation
-  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-    delete files.
-  mitre_attack_id:
-  - T1485
-  - T1070.004
-  - T1070
+  message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently
+    delete files by $dest_user_id$.
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
+  - name: dest_user_id
     type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
   - name: process_name
     type: Process
     role:
     - Child Process
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,5 +86,5 @@ tags:
   - process
   - process_id
   - process_path
-  risk_score: 42
-  security_domain: endpoint
+  - cmd_line
+  security_domain: endpoint

detections/endpoint/ssa___wbadmin_delete_system_backups.yml

@@ -0,0 +1,86 @@
+name: WBAdmin Delete System Backups
+id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
+  Tool) that delete backup files. This is typically used by ransomware to prevent
+  recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" AND
+  like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")  
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+  - https://thedfirreport.com/2020/10/08/ryuks-return/
+  - https://attack.mitre.org/techniques/T1490/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 15
+  risk_severity: high
+  security_domain: endpoint

detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml

@@ -0,0 +1,98 @@
+name: Windows Curl Upload to Remote Destination
+id: cc8d046a-543b-11ec-b864-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of Windows Curl.exe uploading
+  a file to a remote destination. \
+
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
+  \
+
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
+  web application, and it is, for example, how most common HTML forms on the web work.
+  \
+
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible
+  with the Windows version of Curl. Will update if identified adversary tradecraft.
+  \
+
+  Adversaries may use one of the three methods based on the remote destination and
+  what they are attempting to upload (zip vs txt). During triage, review parallel
+  processes for further behavior. In addition, identify if the upload was successful
+  in network logs. If a file was uploaded, isolate the endpoint and review.'
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" AND
+  (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, "%-d %")
+  OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
+
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
+references:
+  - https://everything.curl.dev/usingcurl/uploads
+  - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+  - https://twitter.com/d1r4c/status/1279042657508081664?s=20
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint

detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml

@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Task Scheduler
   and creating a malicious remote scheduled task, the executed command is spawned
-  as a child processs of `svchost.exe`. The LOLBAS project documents Windows native
+  as a child process of `svchost.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of svchost.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -39,7 +39,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -28,7 +28,7 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/windows_service_created_within_public_path.yml

@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2020/07/21/lateral-movement-services/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/windows_service_creation_on_remote_endpoint.yml

@@ -28,7 +28,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/windows_service_initiation_on_remote_endpoint.yml

@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -47,7 +47,7 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - IcedID
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml

@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing Windows Management
-  Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`.
+  Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`.
   The LOLBAS project documents Windows native binaries that can be abused by threat
   actors to perform tasks like executing malicious code. Looking for child processes
   of wmiprvse.exe that are part of the LOLBAS project can help defenders identify
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context: