Branch was auto-updated.

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -1,29 +1,37 @@
-name: Write Executable in SMB Share
+name: Executable File Written in Administrative SMB Share
 id: f63c34fe-a435-11eb-935a-acde48001122
-version: 1
-date: '2021-04-23'
-author: Teoderick Contreras, Splunk
+version: 2
+date: '2021-11-18'
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect suspicious dropping or creating an executable
-  file in known sensitive SMB share. This technique is commonly used for lateral movement
-  like how trickbot try to infect other machine in the infected network. This detection
-  catch the access event (FILE WRITE) access to a share.
+description: The following analytic identifies executable files (.exe or .dll) being
+  written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
+  suspicious behavior as its commonly user by tools like like PsExec/PaExec and others
+  to stage service binaries before creating and starting a Windows service on remote
+  endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
+  movement and remote code execution. The Trickbot malware family also implements
+  this behavior to try to infect other machines in the infected network.
 search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
   Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
   "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
   Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executable_file_written_in_administrative_smb_share_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
   required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: unknown
+known_false_positives: System Administrators may use looks like PsExec for troubleshooting
+  or administrations tasks. However, this will typically come only from certain users
+  and certain systems that can be added to an allow list.
 references:
+- https://attack.mitre.org/techniques/T1021/002/
+- https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/
 - https://labs.vipre.com/trickbot-and-its-modules/
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
+  - Lateral Movement
   - Trickbot
   automated_detection_testing: passed
   confidence: 100

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -0,0 +1,56 @@
+name: Interactive Session on Remote Endpoint with PowerShell
+id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
+version: 1
+date: '2021-11-18'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the usage of the `Enter-PSSession`. This commandlet can be used to open 
+  an interactive session on a remote endpoint leveraging the WinRM protocol.
+  Red Teams and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement and remote code execution.
+search: 'powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks.
+  This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: An interactive session was opened on a remote endpoint from $ComputerName
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -20,7 +20,7 @@ references:
 - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity
 tags:
   analytic_story:
-  - Lateral Movement
+  - Windows Privilege Escalation
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
@@ -34,7 +34,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
   impact: 90
   kill_chain_phases:
-  - Actions on Objectives
+  - Privilege Escalation
   message: Potential kerberoasting attack via service principal name requests detected
     on $dest$
   mitre_attack_id:

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml

@@ -0,0 +1,69 @@
+name: Remote Process Instantiation via DCOM and PowerShell
+id: d4f42098-4680-11ec-ad07-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with arguments
+  utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically,
+  this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams
+  and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and
+  remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*"
+  OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage DCOM to start a process on remote
+  systems, but this activity is usually limited to a small set of hosts or users.
+references:
+- https://attack.mitre.org/techniques/T1021/003/
+- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest by abusing DCOM using
+    PowerShell.exe
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml

@@ -0,0 +1,60 @@
+name: Remote Process Instantiation via DCOM and PowerShell Script Block
+id: fa1c3040-4680-11ec-a618-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of PowerShell with arguments utilized to start a process
+  on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks
+  for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries
+  alike may abuse DCOM for lateral movement and remote code execution.
+search: '`powershell` EventCode=4104 (Message="*Document.Application.ShellExecute*"
+  OR Message="*Document.ActiveView.ExecuteShellCommand*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage DCOM to start a process on remote
+  systems, but this activity is usually limited to a small set of hosts or users.
+references:
+- https://attack.mitre.org/techniques/T1021/003/
+- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WMI using PowerShell.exe
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml

@@ -0,0 +1,70 @@
+name: Remote Process Instantiation via WinRM and PowerShell
+id: ba24cda8-4716-11ec-8009-3e22fbd008af
+version: 1
+date: '2021-11-16'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with arguments
+  utilized to start a process on a remote endpoint by abusing the WinRM protocol.
+  Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
+  Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral
+  movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*"
+  AND Processes.process="*-ComputerName*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `remote_process_instantiation_via_winrm_and_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
+  a process on remote systems for system administration or automation use cases. However,
+  this activity is usually limited to a small set of hosts or users.
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest by abusing WinRM
+    using PowerShell.exe
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml

@@ -0,0 +1,60 @@
+name: Remote Process Instantiation via WinRM and PowerShell Script Block
+id: 7d4c618e-4716-11ec-951c-3e22fbd008af
+version: 1
+date: '2021-11-16'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of PowerShell with arguments utilized to start a process
+  on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks
+  for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike
+  may abuse WinRM for lateral movement and remote code execution.
+search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
+  a process on remote systems for system administration or automation use cases. This activity
+  is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WinRM using PowerShell.exe
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml

@@ -0,0 +1,68 @@
+name: Remote Process Instantiation via WMI and PowerShell
+id: 112638b4-4634-11ec-b9ab-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` leveraging
+  the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start
+  a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may
+  abuse WMI and `powershell.exe` for lateral movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*"
+  AND Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name
+  create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start
+  a process on remote systems, but this activity is usually limited to a small set
+  of hosts or users.
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1047
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest by abusing WMI using
+    PowerShell.exe
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml

@@ -0,0 +1,59 @@
+name: Remote Process Instantiation via WMI and PowerShell Script Block
+id: 2a048c14-4634-11ec-a618-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
+  to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries
+  alike may abuse WMI and this commandlet for lateral movement and remote code execution.
+search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
+  AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+  User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start
+  a process on remote systems, but this activity is usually limited to a small set
+  of hosts or users.
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1047
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WMI using PowerShell.exe
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml

@@ -49,7 +49,6 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
-  - Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -59,7 +58,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log
   impact: 80
   kill_chain_phases:
-  - Lateral Movement
+  - Privilege Escalation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:

detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml

@@ -56,7 +56,6 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
-  - Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -66,7 +65,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log
   impact: 80
   kill_chain_phases:
-  - Lateral Movement
+  - Privilege Escalation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -47,6 +47,7 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - IcedID
+  - Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:

tests/endpoint/executable_file_written_in_administrative_smb_share.test.yml

@@ -1,7 +1,7 @@
-name: Write Executable in SMB Share Unit Test
+name: Executable File Written in Administrative SMB Share Unit Test
 tests:
-- name: Write Executable in SMB Share
-  file: endpoint/write_executable_in_smb_share.yml
+- name: Executable File Written in Administrative SMB Share
+  file: endpoint/executable_file_written_in_administrative_smb_share.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Interactive Session on Remote Endpoint with PowerShell Unit Test
+tests:
+- name: Interactive Session on Remote Endpoint with PowerShell
+  file: endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via DCOM and PowerShell Unit Test
+tests:
+- name: Remote Process Instantiation via DCOM and PowerShell
+  file: endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via DCOM and PowerShell Script Block Unit Test
+tests:
+- name: Remote Process Instantiation via DCOM and PowerShell Script Block
+  file: endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WinRM and PowerShell Unit Test
+tests:
+- name: Remote Process Instantiation via WinRM and PowerShell
+  file: endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WinRM and PowerShell Script Block Unit Test
+tests:
+- name: Remote Process Instantiation via WinRM and PowerShell Script Block
+  file: endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WMI and PowerShell Unit Test
+tests:
+- name: Remote Process Instantiation via WMI and PowerShell
+  file: endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WMI and PowerShell Script Block Unit Test
+tests:
+- name: Remote Process Instantiation via WMI and PowerShell Script Block
+  file: endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog