From d7e88b2e1a0edd4fd5a4aee77b2d717e9f903700 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 15 Nov 2021 15:09:47 -0500
Subject: [PATCH 01/12] adding first two detections

---
 ...s_instantiation_via_wmi_and_powershell.yml | 66 +++++++++++++++++++
 ...on_via_wmi_and_powershell_script_block.yml | 57 ++++++++++++++++
 ...tantiation_via_wmi_and_powershell.test.yml | 12 ++++
 ...a_wmi_and_powershell_script_block.test.yml | 12 ++++
 4 files changed, 147 insertions(+)
 create mode 100644 detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
 create mode 100644 detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
 create mode 100644 tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml
 create mode 100644 tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml

diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
new file mode 100644
index 0000000000..3346ab413b
--- /dev/null
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -0,0 +1,66 @@
+name: Remote Process Instantiation via WMI and PowerShell
+id: 112638b4-4634-11ec-b9ab-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod`
+  commandlet complemented with arguments utilized to start a process on a remote endpoint 
+  by abusing WMI. Red Teams and adversaries alike may abuse the WMI and `powershell.exe` for lateral movement and remote
+  code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe) (Processes.process="*Invoke-WmiMethod*" AND 
+  Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name create*") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process
+  on remote systems, but this activity is usually limited to a small set of hosts
+  or users.
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1047
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest by abusing WMI using PowerShell.exe
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
new file mode 100644
index 0000000000..3e9d62091e
--- /dev/null
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -0,0 +1,57 @@
+name: Remote Process Instantiation via WMI and PowerShell Script Block
+id: 2a048c14-4634-11ec-a618-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint 
+  by abusing WMI. Red Teams and adversaries alike may abuse the WMI and this commandlet for lateral movement and remote
+  code execution.
+search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
+  AND Message="*-Class Win32_Process*" AND Message="*-Name create*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process
+  on remote systems, but this activity is usually limited to a small set of hosts
+  or users.
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1047
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml
new file mode 100644
index 0000000000..da44fe9229
--- /dev/null
+++ b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml
@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WMI and PowerShell Unit Test
+tests:
+- name: Remote Process Instantiation via WMI and PowerShell
+  file: endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml
new file mode 100644
index 0000000000..f81f9a9953
--- /dev/null
+++ b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WMI and PowerShell Script Block Unit Test
+tests:
+- name: Remote Process Instantiation via WMI and PowerShell Script Block
+  file: endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file

From 37845b815d602f204f5173934d910dadedce5618 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 15 Nov 2021 22:42:22 -0500
Subject: [PATCH 02/12] adding 2 extra detections

---
 ..._instantiation_via_dcom_and_powershell.yml | 68 +++++++++++++++++++
 ...n_via_dcom_and_powershell_script_block.yml | 58 ++++++++++++++++
 ...s_instantiation_via_wmi_and_powershell.yml |  4 +-
 ...on_via_wmi_and_powershell_script_block.yml |  8 +--
 ...antiation_via_dcom_and_powershell.test.yml | 12 ++++
 ..._dcom_and_powershell_script_block.test.yml | 12 ++++
 6 files changed, 156 insertions(+), 6 deletions(-)
 create mode 100644 detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
 create mode 100644 detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
 create mode 100644 tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml
 create mode 100644 tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml

diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
new file mode 100644
index 0000000000..ba506a672c
--- /dev/null
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -0,0 +1,68 @@
+name: Remote Process Instantiation via DCOM and PowerShell
+id: d4f42098-4680-11ec-ad07-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint 
+  by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand.
+  Red Teams and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and remote
+  code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*" 
+  OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage DCOM to start a process
+  on remote systems, but this activity is usually limited to a small set of hosts
+  or users.
+references:
+- https://attack.mitre.org/techniques/T1021/003/
+- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest by abusing DCOM using PowerShell.exe
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
new file mode 100644
index 0000000000..2c344f5e57
--- /dev/null
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
@@ -0,0 +1,58 @@
+name: Remote Process Instantiation via DCOM and PowerShell Script Block
+id: fa1c3040-4680-11ec-a618-3e22fbd008af
+version: 1
+date: '2021-11-15'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint 
+  by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand.
+  Red Teams and adversaries alike may abuse DCOM for lateral movement and remote code execution.
+search: '`powershell` EventCode=4104 (Message="*Document.Application.ShellExecute*" OR Message="*Document.ActiveView.ExecuteShellCommand*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage DCOM to start a process
+  on remote systems, but this activity is usually limited to a small set of hosts
+  or users.
+references:
+- https://attack.mitre.org/techniques/T1021/003/
+- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  risk_score: 63
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index 3346ab413b..73ef4a24dc 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -8,10 +8,10 @@ datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod`
   commandlet complemented with arguments utilized to start a process on a remote endpoint 
-  by abusing WMI. Red Teams and adversaries alike may abuse the WMI and `powershell.exe` for lateral movement and remote
+  by abusing WMI. Red Teams and adversaries alike may abuse WMI and `powershell.exe` for lateral movement and remote
   code execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe) (Processes.process="*Invoke-WmiMethod*" AND 
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*" AND 
   Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name create*") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
index 3e9d62091e..62cf565e54 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -8,15 +8,15 @@ datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint 
-  by abusing WMI. Red Teams and adversaries alike may abuse the WMI and this commandlet for lateral movement and remote
+  by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote
   code execution.
 search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
   AND Message="*-Class Win32_Process*" AND Message="*-Name create*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process
   on remote systems, but this activity is usually limited to a small set of hosts
   or users.
diff --git a/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml
new file mode 100644
index 0000000000..c10e1ed666
--- /dev/null
+++ b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml
@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via DCOM and PowerShell Unit Test
+tests:
+- name: Remote Process Instantiation via DCOM and PowerShell
+  file: endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml
new file mode 100644
index 0000000000..6e140c5b77
--- /dev/null
+++ b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via DCOM and PowerShell Script Block Unit Test
+tests:
+- name: Remote Process Instantiation via DCOM and PowerShell Script Block
+  file: endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file

From f521e76d0a1bb53607d276ca6c3bca63956271b8 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 16 Nov 2021 17:41:01 -0500
Subject: [PATCH 03/12] adding two extra detections

---
 ...instantiation_via_winrm_and_powershell.yml | 68 +++++++++++++++++++
 ..._via_winrm_and_powershell_script_block.yml | 58 ++++++++++++++++
 ...ntiation_via_winrm_and_powershell.test.yml | 12 ++++
 ...winrm_and_powershell_script_block.test.yml | 12 ++++
 4 files changed, 150 insertions(+)
 create mode 100644 detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
 create mode 100644 detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
 create mode 100644 tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml
 create mode 100644 tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml

diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
new file mode 100644
index 0000000000..6cc6b97868
--- /dev/null
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -0,0 +1,68 @@
+name: Remote Process Instantiation via WinRM and PowerShell
+id: ba24cda8-4716-11ec-8009-3e22fbd008af
+version: 1
+date: '2021-11-16'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint 
+  by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
+  Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral movement and remote
+  code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*" AND 
+  Processes.process="*-ComputerName*") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process
+  on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts
+  or users.
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest by abusing WinRM using PowerShell.exe
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
new file mode 100644
index 0000000000..945b508755
--- /dev/null
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -0,0 +1,58 @@
+name: Remote Process Instantiation via WinRM and PowerShell Script Block
+id: 7d4c618e-4716-11ec-951c-3e22fbd008af
+version: 1
+date: '2021-11-16'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint 
+  by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
+  Red Teams and adversaries alike may abuse WinRM for lateral movement and remote code execution.
+search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process
+  on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts
+  or users.
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml
new file mode 100644
index 0000000000..192a625346
--- /dev/null
+++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml
@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WinRM and PowerShell Unit Test
+tests:
+- name: Remote Process Instantiation via WinRM and PowerShell
+  file: endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml
new file mode 100644
index 0000000000..f49a35b3b0
--- /dev/null
+++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WinRM and PowerShell Script Block Unit Test
+tests:
+- name: Remote Process Instantiation via WinRM and PowerShell Script Block
+  file: endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file

From 64cf4a3e2495c1106bb4b4a6413becc1a626c5c2 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-120-126>
Date: Wed, 17 Nov 2021 17:05:18 +0000
Subject: [PATCH 04/12] Added detection testing service results inRemote
 Process Instantiation via DCOM and PowerShell

---
 ..._instantiation_via_dcom_and_powershell.yml | 29 ++++++++++---------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
index ba506a672c..e2661b19df 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -6,22 +6,22 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint 
-  by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand.
-  Red Teams and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and remote
-  code execution.
+description: This analytic looks for the execution of `powershell.exe` with arguments
+  utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically,
+  this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams
+  and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and
+  remote code execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*" 
-  OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`'
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*"
+  OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
-known_false_positives: Administrators may leverage DCOM to start a process
-  on remote systems, but this activity is usually limited to a small set of hosts
-  or users.
+known_false_positives: Administrators may leverage DCOM to start a process on remote
+  systems, but this activity is usually limited to a small set of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1021/003/
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
@@ -59,10 +59,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $dest by abusing DCOM using PowerShell.exe
+  message: A process was started on a remote endpoint from $dest by abusing DCOM using
+    PowerShell.exe
   observable:
   - name: dest
     type: Endpoint
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 59ad0b224b3f76985e6b045293d7eafcf69b6d14 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-96-188>
Date: Wed, 17 Nov 2021 17:32:46 +0000
Subject: [PATCH 05/12] Added detection testing service results inRemote
 Process Instantiation via DCOM and PowerShell Script Block

---
 ...n_via_dcom_and_powershell_script_block.yml | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
index 2c344f5e57..488ddda2f7 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
@@ -7,18 +7,19 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint 
-  by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand.
-  Red Teams and adversaries alike may abuse DCOM for lateral movement and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Document.Application.ShellExecute*" OR Message="*Document.ActiveView.ExecuteShellCommand*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`'
+  to identify the execution of PowerShell with arguments utilized to start a process
+  on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks
+  for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries
+  alike may abuse DCOM for lateral movement and remote code execution.
+search: '`powershell` EventCode=4104 (Message="*Document.Application.ShellExecute*"
+  OR Message="*Document.ActiveView.ExecuteShellCommand*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage DCOM to start a process
-  on remote systems, but this activity is usually limited to a small set of hosts
-  or users.
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage DCOM to start a process on remote
+  systems, but this activity is usually limited to a small set of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1021/003/
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
@@ -49,10 +50,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WMI using PowerShell.exe
   observable:
   - name: ComputerName
     type: Endpoint
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 5c8c71e81367274f46763a08d1f09933acec646f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-103-249>
Date: Wed, 17 Nov 2021 17:34:45 +0000
Subject: [PATCH 06/12] Added detection testing service results inRemote
 Process Instantiation via WMI and PowerShell

---
 ...s_instantiation_via_wmi_and_powershell.yml | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index 73ef4a24dc..5afc5c14fd 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -6,22 +6,22 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod`
-  commandlet complemented with arguments utilized to start a process on a remote endpoint 
-  by abusing WMI. Red Teams and adversaries alike may abuse WMI and `powershell.exe` for lateral movement and remote
-  code execution.
+description: This analytic looks for the execution of `powershell.exe` leveraging
+  the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start
+  a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may
+  abuse WMI and `powershell.exe` for lateral movement and remote code execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*" AND 
-  Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name create*") by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*"
+  AND Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name
+  create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
-known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process
-  on remote systems, but this activity is usually limited to a small set of hosts
-  or users.
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start
+  a process on remote systems, but this activity is usually limited to a small set
+  of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1047/
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
@@ -58,9 +58,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $dest by abusing WMI using PowerShell.exe
+  message: A process was started on a remote endpoint from $dest by abusing WMI using
+    PowerShell.exe
   observable:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 16218d8d85f15524cc9794bb7fcf76cbec30fc9a Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-120-126>
Date: Wed, 17 Nov 2021 17:38:32 +0000
Subject: [PATCH 07/12] Added detection testing service results inRemote
 Process Instantiation via WMI and PowerShell Script Block

---
 ...on_via_wmi_and_powershell_script_block.yml | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
index 62cf565e54..7307c4ff74 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -7,19 +7,19 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint 
-  by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote
-  code execution.
+  to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
+  to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries
+  alike may abuse WMI and this commandlet for lateral movement and remote code execution.
 search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
-  AND Message="*-Class Win32_Process*" AND Message="*-Name create*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
+  AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+  User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process
-  on remote systems, but this activity is usually limited to a small set of hosts
-  or users.
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start
+  a process on remote systems, but this activity is usually limited to a small set
+  of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1047/
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
@@ -49,9 +49,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WMI using PowerShell.exe
   observable:
   - name: ComputerName
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From bba838dde1ae20a8907c439206a82e029834cffb Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-247-173>
Date: Wed, 17 Nov 2021 17:59:33 +0000
Subject: [PATCH 08/12] Added detection testing service results inRemote
 Process Instantiation via WinRM and PowerShell

---
 ...instantiation_via_winrm_and_powershell.yml | 30 ++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
index 6cc6b97868..9aeb221ca4 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -6,22 +6,23 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint 
-  by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
-  Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral movement and remote
-  code execution.
+description: This analytic looks for the execution of `powershell.exe` with arguments
+  utilized to start a process on a remote endpoint by abusing the WinRM protocol.
+  Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
+  Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral
+  movement and remote code execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*" AND 
-  Processes.process="*-ComputerName*") by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_powershell_filter`'
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*"
+  AND Processes.process="*-ComputerName*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `remote_process_instantiation_via_winrm_and_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
-known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process
-  on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts
-  or users.
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
+  a process on remote systems for system administration or automation use cases. However,
+  this activity is usually limited to a small set of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1021/006/
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
@@ -59,10 +60,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $dest by abusing WinRM using PowerShell.exe
+  message: A process was started on a remote endpoint from $dest by abusing WinRM
+    using PowerShell.exe
   observable:
   - name: dest
     type: Endpoint
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From a442e207fe4042a8ef11dfc8376deb30d86f45b0 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-251-215>
Date: Wed, 17 Nov 2021 18:00:10 +0000
Subject: [PATCH 09/12] Added detection testing service results inRemote
 Process Instantiation via WinRM and PowerShell Script Block

---
 ..._via_winrm_and_powershell_script_block.yml | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index 945b508755..597d36ea1f 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -7,18 +7,19 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint 
-  by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
-  Red Teams and adversaries alike may abuse WinRM for lateral movement and remote code execution.
+  to identify the execution of PowerShell with arguments utilized to start a process
+  on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks
+  for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike
+  may abuse WinRM for lateral movement and remote code execution.
 search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process
-  on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts
-  or users.
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
+  a process on remote systems for system administration or automation use cases. However,
+  this activity is usually limited to a small set of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1021/006/
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
@@ -49,10 +50,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WinRM using PowerShell.exe
   observable:
   - name: ComputerName
     type: Endpoint
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 7d25f2599cb2e7a487751bff506632c38ba368e1 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 18 Nov 2021 15:43:56 -0500
Subject: [PATCH 10/12] updating other detections

---
 ...e_written_in_administrative_smb_share.yml} | 26 ++++++++++++-------
 ...asting_spn_request_with_rc4_encryption.yml |  4 +--
 ...incipalnames_discovery_with_powershell.yml |  3 +--
 ...ceprincipalnames_discovery_with_setspn.yml |  3 +--
 ...eduled_task_created_within_public_path.yml |  1 +
 ...tten_in_administrative_smb_share.test.yml} |  6 ++---
 6 files changed, 24 insertions(+), 19 deletions(-)
 rename detections/endpoint/{write_executable_in_smb_share.yml => executable_file_written_in_administrative_smb_share.yml} (60%)
 rename tests/endpoint/{write_executable_in_smb_share.test.yml => executable_file_written_in_administrative_smb_share.test.yml} (63%)

diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
similarity index 60%
rename from detections/endpoint/write_executable_in_smb_share.yml
rename to detections/endpoint/executable_file_written_in_administrative_smb_share.yml
index 16363956c9..59ed4ddeb2 100644
--- a/detections/endpoint/write_executable_in_smb_share.yml
+++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
@@ -1,29 +1,35 @@
-name: Write Executable in SMB Share
+name: Executable File Written in Administrative SMB Share
 id: f63c34fe-a435-11eb-935a-acde48001122
-version: 1
-date: '2021-04-23'
-author: Teoderick Contreras, Splunk
+version: 2
+date: '2021-11-18'
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect suspicious dropping or creating an executable
-  file in known sensitive SMB share. This technique is commonly used for lateral movement
-  like how trickbot try to infect other machine in the infected network. This detection
-  catch the access event (FILE WRITE) access to a share.
+description: The following analytic identifies executable files (.exe or .dll) being written to 
+  Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its 
+  commonly user by tools like like PsExec/PaExec and others to stage service binaries before creating and
+  starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares
+  for lateral movement and remote code execution. The Trickbot malware family also implements 
+  this behavior to try to infect other machines in the infected network. 
 search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
   Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
   "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
   Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executable_file_written_in_administrative_smb_share_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
   required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: unknown
+known_false_positives: System Administrators may use looks like PsExec for troubleshooting or administrations tasks.
+  However, this will typically come only from certain users and certain systems that can be added to an allow list.
 references:
+- https://attack.mitre.org/techniques/T1021/002/
+- https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/
 - https://labs.vipre.com/trickbot-and-its-modules/
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
+  - Lateral Movement
   - Trickbot
   automated_detection_testing: passed
   confidence: 100
diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
index 16e0546134..70038db580 100644
--- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
+++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
@@ -20,7 +20,7 @@ references:
 - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity
 tags:
   analytic_story:
-  - Lateral Movement
+  - Windows Privilege Escalation
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
@@ -34,7 +34,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
   impact: 90
   kill_chain_phases:
-  - Actions on Objectives
+  - Privilege Escalation
   message: Potential kerberoasting attack via service principal name requests detected
     on $dest$
   mitre_attack_id:
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
index 4b5df4d8ce..6430c8a73b 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
@@ -49,7 +49,6 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
-  - Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -59,7 +58,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log
   impact: 80
   kill_chain_phases:
-  - Lateral Movement
+  - Privilege Escalation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
index ef17a5ca2a..2f456df538 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
@@ -56,7 +56,6 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
-  - Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -66,7 +65,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log
   impact: 80
   kill_chain_phases:
-  - Lateral Movement
+  - Privilege Escalation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to identify service principle names.
   mitre_attack_id:
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index b34070f242..0091f8b44b 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -47,6 +47,7 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - IcedID
+  - Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/tests/endpoint/write_executable_in_smb_share.test.yml b/tests/endpoint/executable_file_written_in_administrative_smb_share.test.yml
similarity index 63%
rename from tests/endpoint/write_executable_in_smb_share.test.yml
rename to tests/endpoint/executable_file_written_in_administrative_smb_share.test.yml
index 83a55cd08a..0f5150c79a 100644
--- a/tests/endpoint/write_executable_in_smb_share.test.yml
+++ b/tests/endpoint/executable_file_written_in_administrative_smb_share.test.yml
@@ -1,7 +1,7 @@
-name: Write Executable in SMB Share Unit Test
+name: Executable File Written in Administrative SMB Share Unit Test
 tests:
-- name: Write Executable in SMB Share
-  file: endpoint/write_executable_in_smb_share.yml
+- name: Executable File Written in Administrative SMB Share
+  file: endpoint/executable_file_written_in_administrative_smb_share.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From f18afbbd8cf7cd215e6c774bbcf09312db93c8cc Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-99-6>
Date: Thu, 18 Nov 2021 21:05:53 +0000
Subject: [PATCH 11/12] Added detection testing service results inExecutable
 File Written in Administrative SMB Share

---
 ...ile_written_in_administrative_smb_share.yml | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
index 59ed4ddeb2..cea14e9c2d 100644
--- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
@@ -6,12 +6,13 @@ author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies executable files (.exe or .dll) being written to 
-  Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its 
-  commonly user by tools like like PsExec/PaExec and others to stage service binaries before creating and
-  starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares
-  for lateral movement and remote code execution. The Trickbot malware family also implements 
-  this behavior to try to infect other machines in the infected network. 
+description: The following analytic identifies executable files (.exe or .dll) being
+  written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
+  suspicious behavior as its commonly user by tools like like PsExec/PaExec and others
+  to stage service binaries before creating and starting a Windows service on remote
+  endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
+  movement and remote code execution. The Trickbot malware family also implements
+  this behavior to try to infect other machines in the infected network.
 search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
   Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
   "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
@@ -20,8 +21,9 @@ search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe",
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
   required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: System Administrators may use looks like PsExec for troubleshooting or administrations tasks.
-  However, this will typically come only from certain users and certain systems that can be added to an allow list.
+known_false_positives: System Administrators may use looks like PsExec for troubleshooting
+  or administrations tasks. However, this will typically come only from certain users
+  and certain systems that can be added to an allow list.
 references:
 - https://attack.mitre.org/techniques/T1021/002/
 - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/

From 399ebb4e7f83ba7b18ae0b5960b866c4dce0af96 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 18 Nov 2021 16:26:32 -0500
Subject: [PATCH 12/12] adding extra detection

---
 ...ion_on_remote_endpoint_with_powershell.yml | 56 +++++++++++++++++++
 ..._via_winrm_and_powershell_script_block.yml |  4 +-
 ...n_remote_endpoint_with_powershell.test.yml | 12 ++++
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
 create mode 100644 tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml

diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
new file mode 100644
index 0000000000..58d8c2ef3c
--- /dev/null
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -0,0 +1,56 @@
+name: Interactive Session on Remote Endpoint with PowerShell
+id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
+version: 1
+date: '2021-11-18'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the usage of the `Enter-PSSession`. This commandlet can be used to open 
+  an interactive session on a remote endpoint leveraging the WinRM protocol.
+  Red Teams and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement and remote code execution.
+search: 'powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks.
+  This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: An interactive session was opened on a remote endpoint from $ComputerName
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index 597d36ea1f..56aa9292c0 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -18,8 +18,8 @@ how_to_implement: To successfully implement this analytic, you will need to enab
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
-  a process on remote systems for system administration or automation use cases. However,
-  this activity is usually limited to a small set of hosts or users.
+  a process on remote systems for system administration or automation use cases. This activity
+  is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
 references:
 - https://attack.mitre.org/techniques/T1021/006/
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
diff --git a/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml b/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml
new file mode 100644
index 0000000000..a4be81cd7e
--- /dev/null
+++ b/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml
@@ -0,0 +1,12 @@
+name: Interactive Session on Remote Endpoint with PowerShell Unit Test
+tests:
+- name: Interactive Session on Remote Endpoint with PowerShell
+  file: endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file