fix_issues

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious parent process execution of commandline
-  tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile
-  payload where it run ipconfig.exe and systeminfo.exe using .net application. This
-  event cause some good TTP since those tool are commonly run in commandline not by
-  another application. This TTP is a good indicator for application gather host information
-  either an attacker or an automated tool made by admin.
+description: This search is to detect a suspicious non-command shell process (e.g. cmd.exe, powershell.exe) 
+  spawning windows console application (e.g ipconfig.exe, systeminfo.exe). 
+  This technique was seen in FIN7 loader implant that executes existing windows console tools or application 
+  to gather system information from the compromised host. 
+  This TTP is a good indicator for possible advesaries implant, malware doing a recon on a target host 
+  or a third party application run by administrator for audit purposes. 
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
   OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -10,12 +10,12 @@ description: this detection was designed to identifies suspicious spawned proces
   of known MS office application due to macro or malicious code. this technique can
   be seen in so many malware like trickbot that used MS office as its weapon or attack
   vector to initially infect the machines.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
-  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") `process_rundll32`  by
-  Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid
-  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") AND `process_rundll32` 
+  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest 
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)`
   | `office_application_spawn_rundll32_process_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml

@@ -1,4 +1,4 @@
-name: Regsvr32 Silent Param Dll Loading
+name: Regsvr32 Silent and Install Param Dll Loading
 id: f421c250-24e7-11ec-bc43-acde48001122
 version: 1
 date: '2021-10-04'
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process
   Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`'
+  | `security_content_ctime(lastTime)` | `regsvr32_silent_and_install_param_dll_loading_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml

@@ -1,4 +1,4 @@
-name: Suspicious IcedID Regsvr32 Cmdline
+name: Regsvr32 with Known Silent Switch Cmdline
 id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
 version: 2
 date: '2021-07-27'
@@ -11,11 +11,13 @@ description: this search is to detect a suspicious regsvr32 commandline "-s" to
   dll that will download the 2nd stage loader that will download and decrypt the config
   payload.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*-s*
-  by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
-  Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
-  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_icedid_regsvr32_cmdline_filter`'
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32`
+  (Processes.process="*/i*" AND Processes.process="*/s*") OR Processes.process="*/si*" OR Processes.process="*-si*" by Processes.dest Processes.parent_process
+  Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `regsvr32_with_known_silent_switch_cmdline_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

tests/endpoint/regsvr32_silent_and_install_param_dll_loading.test.yml

@@ -1,7 +1,7 @@
-name: Regsvr32 Silent Param Dll Loading Unit Test
+name: Regsvr32 Silent and Install Param Dll Loading Unit Test
 tests:
-- name: Regsvr32 Silent Param Dll Loading
-  file: endpoint/regsvr32_silent_param_dll_loading.yml
+- name: Regsvr32 Silent and Install Param Dll Loading
+  file: endpoint/regsvr32_silent_and_install_param_dll_loading.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/endpoint/regsvr32_with_known_silent_switch_cmdline.test.yml

@@ -1,7 +1,7 @@
-name: Suspicious IcedID Regsvr32 Cmdline Unit Test
+name: Regsvr32 with Known Silent Switch Cmdline Unit Test
 tests:
-- name: Suspicious IcedID Regsvr32 Cmdline
-  file: endpoint/suspicious_icedid_regsvr32_cmdline.yml
+- name: Regsvr32 with Known Silent Switch Cmdline
+  file: endpoint/regsvr32_with_known_silent_switch_cmdline.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'