updates

detections/endpoint/account_discovery_with_net_app.yml

@@ -1,7 +1,7 @@
 name: Account Discovery With Net App
 id: 339805ce-ac30-11eb-b87d-acde48001122
-version: 2
-date: '2021-05-03'
+version: 3
+date: '2021-09-16'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -16,9 +16,7 @@ description: this search is to detect a potential account discovery series of co
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_net` AND
-  (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view
-  /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
+  where `process_net` AND (Processes.process="*user*" OR  Processes.process="*config*" OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user Processes.parent_process_name
   | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product..

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -1,14 +1,14 @@
 name: Attempt To Add Certificate To Untrusted Store
 id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
-version: 6
-date: '2020-11-03'
+version: 7
+date: '2021-09-16'
 author: Patrick Bareiss, Rico Valdez, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: Attempt To Add Certificate To Untrusted Store
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
-  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil*
+  as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
   (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`

detections/endpoint/detect_html_help_renamed.yml

@@ -1,11 +1,11 @@
 name: Detect HTML Help Renamed
 id: 62fed254-513b-460e-953d-79771493a9f3
 version: 3
-date: '2021-02-11'
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
-- Endpoint
+  - Endpoint
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any

detections/endpoint/detect_mshta_renamed.yml

@@ -1,10 +1,11 @@
 name: Detect mshta renamed
 id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
 version: 2
-date: '2021-01-20'
+date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
-datamodel: []
+type: Hunting
+datamodel:
+  - Endpoint
 description: The following analytic identifies renamed instances of mshta.exe executing.
   Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
   analytic utilizes the internal name of the PE to identify if is the legitimate mshta

detections/endpoint/suspicious_rundll32_rename.yml

@@ -3,7 +3,7 @@ id: 7360137f-abad-473e-8189-acbdaa34d114
 version: 3
 date: '2021-02-04'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel: 
 - Endpoint
 description: The following analytic identifies renamed instances of rundll32.exe executing.