updaing password spraying detection names

detections/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.ym

@@ -1,4 +1,4 @@
-name: Failed NTLM Authentication attempts from one source with multiple valid users
+name: Multiple Valid Users Failing To Authenticate From One Source Using NTLM
 id: 7ed272a4-9c77-11eb-af22-acde48001122
 version: 1
 date: '2021-04-13'

detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml

@@ -1,4 +1,4 @@
-name: Failed Authentication attempts from one process with multiple users
+name: Multiple Users Failing To Authentication From One Process
 id: 9015385a-9c84-11eb-bef2-acde48001122
 version: 1
 date: '2021-04-13'

detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml

@@ -1,4 +1,4 @@
-name: Failed Kerberos Authentication attempts from one source with multiple valid users
+name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos
 id: 3a91a212-98a9-11eb-b86a-acde48001122
 version: 1
 date: '2021-04-08'

detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml

@@ -1,4 +1,4 @@
-name: Failed Authentication attempts using explit credentials with multiple users
+name: Multiple Users Failing To Authenticate Using Explicit Credentials
 id: e61918fa-9ca4-11eb-836c-acde48001122
 version: 1
 date: '2021-04-13'
@@ -11,13 +11,17 @@ This behavior could represent an adversary performing a Password Spraying attack
 In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments.
 Event 4648 is generated when a process attempts an account logon by explicitly specifying that account’s credentials. This event generates on domain controllers, member servers, and workstations.
 
-This detection will trigger on the potenfially malicious host, perhaps conrtrolled via a trojan, from where a password spraying attack is being executed.
+This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a
+password spraying attack is being executed.
 
+The analytic's returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.
 
 search: '| UPDATE_SPL | `failed_authentication_attempts_using_explit_credentials_with_multiple_users_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as 
 well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. 
+Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list.
+Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
 references:
   - https://attack.mitre.org/techniques/T1110/003/ 
   - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648

detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml

@@ -1,4 +1,4 @@
-name: Failed Remote Authentication attemtps from one source with multiple users
+name: Multiple Users Remotely Failing To Authenticate From One Source
 id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
 version: 1
 date: '2021-04-13'
@@ -12,7 +12,7 @@ description: The following analytic identifies a source host failing to authenti
  Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 
  describes an remote authentication attempt.
 
- This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as member servers and workstations.
+ This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server orworkstation.
 
  The analytic's returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.
 
@@ -20,7 +20,8 @@ search: 'EventCode=4625 Logon_Type=3  Source_Network_Address!="-" | eval Destin
  stats  dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by Source_Network_Address, ComputerName | where  unique_accounts > 10'
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as 
 as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. 
+Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
 references:
   - https://attack.mitre.org/techniques/T1110/003/ 
   - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

tests/endpoint/failed_authentication_attempts_from_one_process_with_multiple_users.test.yml

@@ -1,12 +0,0 @@
-name: Failed Authentication attempts from one process with multiple users Unit Test
-tests:
-- name: Multiple Failed Authentication attempts from one process with various users
-  file: detections/endpoint/multiple_failed_authentication_attempts_from_one_process_with_various_users.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.test.yml

@@ -1,12 +0,0 @@
-name: Failed Authentication attempts using explit credentials with multiple users Unit Test
-tests:
-- name: Failed Authentication attempts using explit credentials with multiple users
-  file: detections/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/failed_kerberos_authentication_attempts_from_one_source_with_multiple_users.test.yml

@@ -1,12 +0,0 @@
-name: Failed Kerberos Authentication attempts from one source with multiple unique valid users Unit Test
-tests:
-- name: Multiple Failed Kerberos Authentication attempts from one source with multiple unique valid users
-  file: endpoint/multiple_failed_kerberos_authentication_attempts_from_one_source_with_multiple_unique_valid_users.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/failed_ntlm_authentication_attempts_from_one_source_with_multiple_users.test.yml

@@ -1,12 +0,0 @@
-name: Failed NTLM Authentication attempts from one source with multiple valid users Unit Test
-tests:
-- name: Multiple Failed NTLM Authentication attempts from one source with multiple valid users
-  file: detections/endpoint/multiple_failed_ntlm_authentication_attempts_from_one_source_with_multiple_valid_users.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.test.yml

@@ -1,12 +0,0 @@
-name: Failed Remote Authentication attemtps from one source with multiple users Unit Test
-tests:
-- name: Failed Remote Authentication attemtps from one source with multiple users
-  file: detections/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.test.yml

@@ -0,0 +1,12 @@
+name: FMultiple Valid Users Failing To Authenticate From One Source Using NTLM Unit Test
+tests:
+- name: Multiple Valid Users Failing To Authenticate From One Source Using NTLM
+  file: detections/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/multiple_users_failing_to_authenticate_from_one_process.test.yml

@@ -0,0 +1,12 @@
+name: Multiple Users Failing To Authentication From One Process Unit Test
+tests:
+- name: Multiple Users Failing To Authentication From One Process
+  file: detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos Unit Test
+tests:
+- name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos
+  file: endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.test.yml

@@ -0,0 +1,12 @@
+name: Multiple Users Failing To Authenticate Using Explicit Credentials Unit Test
+tests:
+- name: Multiple Users Failing To Authenticate Using Explicit Credentials
+  file: detections/endpoint/multiple_users_failing_to_authenticate_using_explict_credentials.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.test.yml

@@ -0,0 +1,12 @@
+name: Multiple Users Remotely Failing To Authenticate From One Source Unit Test
+tests:
+- name: Multiple Users Remotely Failing To Authenticate From One Source
+  file: detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE