From 29ab52ac0b45896c0f6a620933dffbe7eafd4aae Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 30 Sep 2022 05:26:16 -0600
Subject: [PATCH 01/15] ProxyNotShell  - A Tale of CVE-2022-41040 and
 CVE-2022-41082

---
 ...load_with_urlcache_and_split_arguments.yml |  1 +
 ...cmd_carry_out_string_command_parameter.yml |  1 +
 .../endpoint/detect_exchange_web_shell.yml    |  9 ++++----
 detections/endpoint/w3wp_spawning_shell.yml   |  1 +
 .../exchange_powershell_abuse_via_ssrf.yml    |  1 +
 stories/proxynotshell.yml                     | 22 +++++++++++++++++++
 6 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 stories/proxynotshell.yml

diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 6bbe7450e2..7fa93e0542 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -35,6 +35,7 @@ tags:
   - Ingress Tool Transfer
   - DarkSide Ransomware
   - Living Off The Land
+  - ProxyNotShell
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index 3740b61486..0f2f344831 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -38,6 +38,7 @@ tags:
   - Living Off The Land
   - Azorult
   - DarkCrystal RAT
+  - ProxyNotShell
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index 119515b9bd..ee2ff1cf62 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -1,14 +1,14 @@
 name: Detect Exchange Web Shell
 id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
-version: 3
-date: '2021-10-05'
+version: 4
+date: '2022-09-30'
 author: Michael Haag, Shannon Davis, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: 'The following query identifies suspicious .aspx created in 3 paths identified
   by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
-  group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`,
+  group and recently disclosed vulnerablity named ProxyShell and ProxyNotShell. Paths include: `\HttpProxy\owa\auth\`,
   `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious
   .aspx file will likely look obvious on the surface. inspect the contents for script
   code inside. Identify additional log sources, IIS included, to review source and
@@ -30,7 +30,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
   tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*",
-  "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
+  "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name IN( "*.aspx", "*.ashx")
   by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
   Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
   file_name file_path process_name process_path process] | dedup file_create_time
@@ -52,6 +52,7 @@ tags:
   - HAFNIUM Group
   - ProxyShell
   - CISA AA22-257A
+  - ProxyNotShell
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 76f464f205..54a827a779 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -39,6 +39,7 @@ tags:
   - HAFNIUM Group
   - ProxyShell
   - CISA AA22-257A
+  - ProxyNotShell
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
index 1672164f73..014eaac725 100644
--- a/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
+++ b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - ProxyShell
+  - ProxyNotShell
   asset_type: Endpoint
   confidence: 100
   context:
diff --git a/stories/proxynotshell.yml b/stories/proxynotshell.yml
new file mode 100644
index 0000000000..b2b7439e34
--- /dev/null
+++ b/stories/proxynotshell.yml
@@ -0,0 +1,22 @@
+name: ProxyNotShell
+id: 4e3f17e7-9ed7-425d-a05e-b65464945836
+version: 1
+date: '2022-09-30'
+author: Michael Haag, Splunk
+description: Two new zero day Microsoft Exchange vulnerabilities have been identified actively exploited in the wild - CVE-2022-41040 and CVE-2022-41082.
+narrative: Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker. Originally identified by GTSC monitoring Exchange, some adversary post-exploitation activity was identified and is tagged to this story.
+references:
+  - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
+  - https://twitter.com/GossiTheDog/status/1575762721353916417?s=20&t=67gq9xCWuyPm1VEm8ydfyA
+  - https://twitter.com/cglyer/status/1575793769814728705?s=20&t=67gq9xCWuyPm1VEm8ydfyA
+  - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
+  - https://research.splunk.com/stories/proxyshell/
+tags:
+  analytic_story: ProxyNotShell
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 061e486514d829881afa0921fa9d1c0f605474a1 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sun, 2 Oct 2022 06:52:53 -0600
Subject: [PATCH 02/15] Update exchange_powershell_abuse_via_ssrf.yml

Resolving #2397
---
 .../endpoint/exchange_powershell_abuse_via_ssrf.yml         | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
index 014eaac725..d5a456f636 100644
--- a/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
+++ b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
@@ -1,7 +1,7 @@
 name: Exchange PowerShell Abuse via SSRF
 id: 29228ab4-0762-11ec-94aa-acde48001122
-version: 1
-date: '2021-08-27'
+version: 2
+date: '2022-10-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -20,7 +20,7 @@ description: 'This analytic identifies suspicious behavior related to ProxyShell
 
   Review the source attempting to perform this activity against your environment.
   In addition, review PowerShell logs and access recently granted to Exchange roles.'
-search: '| `exchange` c_uri="*//autodiscover.json*" cs_uri_query="*PowerShell*" cs_method="POST"
+search: '`exchange` c_uri="*//autodiscover.json*" cs_uri_query="*PowerShell*" cs_method="POST"
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, cs_uri_query,
   cs_method, c_uri | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_abuse_via_ssrf_filter`'

From edd5db1f636c889dc326881e6a25ebb2d32cf5f2 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 3 Oct 2022 20:39:20 -0600
Subject: [PATCH 03/15] Update unified_messaging_service_spawning_a_process.yml

---
 .../unified_messaging_service_spawning_a_process.yml      | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
index 6848554959..077c9efb4f 100644
--- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml
+++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
@@ -1,7 +1,7 @@
 name: Unified Messaging Service Spawning a Process
 id: f1126df0-7bd5-11eb-988f-acde48001122
-version: 1
-date: '2021-03-02'
+version: 2
+date: '2022-10-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -18,7 +18,7 @@ description: This detection identifies Microsoft Exchange Server's Unified Messa
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe"
   OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe"
-  OR Processes.process_name!="werfault.exe") by Processes.dest Processes.user Processes.parent_process
+  OR Processes.process_name!="werfault.exe") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `unified_messaging_service_spawning_a_process_filter`'
@@ -35,6 +35,8 @@ references:
 tags:
   analytic_story:
   - HAFNIUM Group
+  - ProxyShell
+  - ProxyNotShell
   confidence: 80
   context:
   - Source:Endpoint

From 60310f355b09e4680f841b3859f4a00cdb8f3aeb Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 3 Oct 2022 22:07:25 -0600
Subject: [PATCH 04/15] Windows Exchange Autodiscover Abuse

---
 .../windows_exchange_autodiscover_abuse.yml   | 80 +++++++++++++++++++
 ...ndows_exchange_autodiscover_abuse.test.yml | 13 +++
 2 files changed, 93 insertions(+)
 create mode 100644 detections/web/windows_exchange_autodiscover_abuse.yml
 create mode 100644 tests/web/windows_exchange_autodiscover_abuse.test.yml

diff --git a/detections/web/windows_exchange_autodiscover_abuse.yml b/detections/web/windows_exchange_autodiscover_abuse.yml
new file mode 100644
index 0000000000..1f618ade25
--- /dev/null
+++ b/detections/web/windows_exchange_autodiscover_abuse.yml
@@ -0,0 +1,80 @@
+name: Windows Exchange Autodiscover Abuse
+id: d436f9e7-0ee7-4a47-864b-6dea2c4e2752
+version: 1
+date: '2022-10-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic utilizes the Web datamodel and identifies the ProxyShell or ProxyNotShell abuse. This analytic looks for the URI path and query of autodiscover, powershell and mapi along with a POST occurring. It will tally a simple score and show the output of the events that match.
+  This analytic may be added to by simply creating a new eval statement and modifying the hardcode digit for Score.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where (Web.status=200 OR Web.status=302 OR Web.status=401) AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method Web.uri_query
+  | `drop_dm_object_name("Web")`
+  | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover%"),1,0)
+  | eval powershell = if(match(lower(uri_query),"powershell"), "1",0)
+  | eval mapi=if(like(uri_query,"%/mapi/%"),1,0)
+  | addtotals fieldname=Score is_autodiscover, powershell, mapi
+  | fields Score, src,dest, status, uri_query,uri_path,http_method
+  | where Score >= 2
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_exchange_autodiscover_abuse_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed.
+known_false_positives: False positivies are limited.
+references:
+  - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
+  - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
+  - https://twitter.com/GossiTheDog/status/1575762721353916417?s=20&t=67gq9xCWuyPm1VEm8ydfyA
+  - https://twitter.com/cglyer/status/1575793769814728705?s=20&t=67gq9xCWuyPm1VEm8ydfyA
+  - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
+  - https://research.splunk.com/stories/proxyshell/
+  - https://docs.splunk.com/Documentation/AddOns/released/MSIIS
+tags:
+  cve:
+  - CVE-2021-34523
+  - CVE-2021-34473
+  - CVE-2021-31207
+  - CVE-2022-41040
+  - CVE-2022-41082
+  analytic_story:
+  - ProxyShell
+  - ProxyNotShell
+  asset_type: Web server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/proxyshell/proxyshell.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message:  Activity related to ProxyShell or ProxyNotShell has been identified on $dest$. Review events
+    and take action accordingly.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.src 
+  - Web.status 
+  - Web.uri_path 
+  - Web.dest 
+  - Web.http_method 
+  - Web.uri_query
+  risk_score: 72
+  security_domain: network
diff --git a/tests/web/windows_exchange_autodiscover_abuse.test.yml b/tests/web/windows_exchange_autodiscover_abuse.test.yml
new file mode 100644
index 0000000000..c51a91c062
--- /dev/null
+++ b/tests/web/windows_exchange_autodiscover_abuse.test.yml
@@ -0,0 +1,13 @@
+name: Windows Exchange Autodiscover Abuse Unit Test
+tests:
+- name: Windows Exchange Autodiscover Abuse
+  file: web/windows_exchange_autodiscover_abuse.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: proxyshell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/proxyshell/proxyshell.log
+    source: ms:iis:splunk
+    sourcetype: ms:iis:splunk
+    update_timestamp: true
\ No newline at end of file

From 90431ca751510e2ea592624a7cedf96221f24aff Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 4 Oct 2022 11:37:24 -0600
Subject: [PATCH 05/15] updates

---
 detections/web/windows_exchange_autodiscover_abuse.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/web/windows_exchange_autodiscover_abuse.yml b/detections/web/windows_exchange_autodiscover_abuse.yml
index 1f618ade25..f70e70c6e9 100644
--- a/detections/web/windows_exchange_autodiscover_abuse.yml
+++ b/detections/web/windows_exchange_autodiscover_abuse.yml
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(lastTime)`
   | `windows_exchange_autodiscover_abuse_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed.
-known_false_positives: False positivies are limited.
+known_false_positives: False positives are limited.
 references:
   - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
   - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

From 343a8d36983420b34e1eff00a6f9c3b6d44a83bb Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 5 Oct 2022 10:20:07 -0600
Subject: [PATCH 06/15] Updates + new

---
 .../exchange_powershell_module_usage.yml      | 21 +++---
 ...d_messaging_service_spawning_a_process.yml |  3 +-
 .../endpoint/windows_create_local_account.yml | 64 +++++++++++++++++++
 stories/cisa_aa22_277a.yml                    | 19 ++++++
 .../exchange_powershell_module_usage.test.yml | 12 ++++
 .../windows_create_local_account.test.yml     | 13 ++++
 6 files changed, 120 insertions(+), 12 deletions(-)
 rename detections/{experimental => }/endpoint/exchange_powershell_module_usage.yml (86%)
 create mode 100644 detections/endpoint/windows_create_local_account.yml
 create mode 100644 stories/cisa_aa22_277a.yml
 create mode 100644 tests/endpoint/exchange_powershell_module_usage.test.yml
 create mode 100644 tests/endpoint/windows_create_local_account.test.yml

diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/endpoint/exchange_powershell_module_usage.yml
similarity index 86%
rename from detections/experimental/endpoint/exchange_powershell_module_usage.yml
rename to detections/endpoint/exchange_powershell_module_usage.yml
index d04eae8669..eed9d7e64c 100644
--- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/endpoint/exchange_powershell_module_usage.yml
@@ -1,14 +1,12 @@
 name: Exchange PowerShell Module Usage
 id: 2d10095e-05ae-11ec-8fdf-acde48001122
-version: 3
-date: '2022-09-22'
+version: 4
+date: '2022-10-05'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: 'The following analytic identifies the usage of Exchange PowerShell modules
-  that were recently used for a proof of concept related to ProxyShell. Currently,
-  there is no active data shared or data we could re-produce relate to this part of
-  the ProxyShell chain of exploits.  \
+  that were recently used for a proof of concept related to ProxyShell. Adversaries may abuse a limited set of PwSh Modules related to Exchange once gained access via ProxyShell or ProxyNotShell.\
 
   Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
   and user, of the session will assist with determining the intent. \
@@ -40,22 +38,25 @@ references:
   - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
   - https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
   - https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
+  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
 tags:
   analytic_story:
   - ProxyShell
   - CISA AA22-264A
+  - ProxyNotShell
   asset_type: Endpoint
-  confidence: 50
+  confidence: 80
   context:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  dataset: []
-  impact: 30
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
+  impact: 40
   kill_chain_phases:
   - Reconnaissance
   - Exploitation
-  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  message: Suspicious Exchange PowerShell module usaged was identified on $dest$.
   mitre_attack_id:
   - T1059
   - T1059.001
@@ -75,5 +76,5 @@ tags:
   - Computer
   - UserID
   - EventCode
-  risk_score: 15
+  risk_score: 32
   security_domain: endpoint
diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
index 077c9efb4f..1a18c5ac6f 100644
--- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml
+++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
@@ -17,8 +17,7 @@ description: This detection identifies Microsoft Exchange Server's Unified Messa
   public access to Exchange. In final, patch the vulnerablity and monitor.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe"
-  OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe"
-  OR Processes.process_name!="werfault.exe") by Processes.dest Processes.user Processes.parent_process_name
+  OR Processes.parent_process_name="UMService.exe" NOT (Processes.process_name IN ("wermgr.exe", "werfault.exe")) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `unified_messaging_service_spawning_a_process_filter`'
diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml
new file mode 100644
index 0000000000..91d94e13d9
--- /dev/null
+++ b/detections/endpoint/windows_create_local_account.yml
@@ -0,0 +1,64 @@
+name: Windows Create Local Account
+id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb
+version: 1
+date: '2022-10-05'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.
+search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
+  result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change
+  where All_Changes.result_id=4720 by 
+  All_Changes.user All_Changes.dest All_Changes.result All_Changes.action | `drop_dm_object_name("All_Changes")` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  | `windows_create_local_account_filter`'
+how_to_implement: 'This search requires you to have enabled your Group Management
+  Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More
+  information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/'
+known_false_positives: It is possible that an administrator created the account. Verifying activity with an administrator is advised. This analytic is set to anomaly to allow for risk to be added. Filter and tune as needed. Restrict to critical infrastructure to reduce any volume.
+references:
+  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
+tags:
+  analytic_story:
+  - Account Monitoring and Controls
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/4720.log
+  impact: 20
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: The following $user$ was added to $dest$ as a local account.
+  mitre_attack_id:
+  - T1136.001
+  - T1136
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - All_Changes.user 
+  - All_Changes.dest 
+  - All_Changes.result 
+  - All_Changes.action 
+  risk_score: 18
+  security_domain: endpoint
\ No newline at end of file
diff --git a/stories/cisa_aa22_277a.yml b/stories/cisa_aa22_277a.yml
new file mode 100644
index 0000000000..cf280c5032
--- /dev/null
+++ b/stories/cisa_aa22_277a.yml
@@ -0,0 +1,19 @@
+name: CISA AA22-277A
+id: db408f93-e915-4215-9962-5fada348bdd7
+version: 1
+date: '2022-10-05'
+author: Michael Haag, Splunk
+description: From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization's enterprise network. During incident response activities, multiple utilities were utilized.
+narrative: CISA uncovered that likely multiple APT groups compromised the organization's network, and some APT actors had long-term access to the environment. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim's sensitive data.
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-277a
+  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-277a-impacket-and-exfiltration-tool-used-to-steal-sensitive-information-from-defense-industrial-base-organization.pdf
+tags:
+  analytic_story: CISA AA22-277A
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
diff --git a/tests/endpoint/exchange_powershell_module_usage.test.yml b/tests/endpoint/exchange_powershell_module_usage.test.yml
new file mode 100644
index 0000000000..24e4959dd2
--- /dev/null
+++ b/tests/endpoint/exchange_powershell_module_usage.test.yml
@@ -0,0 +1,12 @@
+name: Exchange PowerShell Module Usage Unit Test
+tests:
+- name: Exchange PowerShell Module Usage
+  file: endpoint/exchange_powershell_module_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/windows_create_local_account.test.yml b/tests/endpoint/windows_create_local_account.test.yml
new file mode 100644
index 0000000000..562b88f095
--- /dev/null
+++ b/tests/endpoint/windows_create_local_account.test.yml
@@ -0,0 +1,13 @@
+name: Windows Create Local Account Unit Test
+tests:
+- name: Windows Create Local Account
+  file: endpoint/windows_create_local_account.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 4720.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/4720.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From f29367bf371e500656d275604d1e42a62dae89de Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 6 Oct 2022 16:07:25 -0600
Subject: [PATCH 07/15] CISA and mimikatz add

---
 .../certutil_download_with_urlcache_and_split_arguments.yml    | 1 +
 detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml | 1 +
 .../endpoint/create_or_delete_windows_shares_using_net_exe.yml | 1 +
 detections/endpoint/detect_renamed_winrar.yml                  | 1 +
 detections/endpoint/excessive_usage_of_taskkill.yml            | 1 +
 detections/endpoint/exchange_powershell_module_usage.yml       | 1 +
 .../impacket_lateral_movement_commandline_parameters.yml       | 1 +
 detections/endpoint/network_connection_discovery_netstat.yml   | 1 +
 .../endpoint/network_discovery_using_route_windows_app.yml     | 1 +
 lookups/attacker_tools.csv                                     | 3 ++-
 10 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 7fa93e0542..878ddb76be 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -36,6 +36,7 @@ tags:
   - DarkSide Ransomware
   - Living Off The Land
   - ProxyNotShell
+  - CISA AA22-277A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
index c8f69706d3..dc2ca5fba4 100644
--- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
+++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - FIN7
+  - CISA AA22-277A
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index 3826c9058d..c81155fd0c 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Hidden Cobra Malware
+  - CISA AA22-277A
   asset_type: Endpoint
   cis20:
   - CIS 8
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 6cbd969d01..fe95086749 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Collection and Staging
+  - CISA AA22-277A
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml
index 7e0d7a6775..fe91ac5395 100644
--- a/detections/endpoint/excessive_usage_of_taskkill.yml
+++ b/detections/endpoint/excessive_usage_of_taskkill.yml
@@ -29,6 +29,7 @@ tags:
   - Azorult
   - CISA AA22-264A
   - AgentTesla
+  - CISA AA22-277A
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/exchange_powershell_module_usage.yml b/detections/endpoint/exchange_powershell_module_usage.yml
index eed9d7e64c..f23d51c2c3 100644
--- a/detections/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/endpoint/exchange_powershell_module_usage.yml
@@ -44,6 +44,7 @@ tags:
   - ProxyShell
   - CISA AA22-264A
   - ProxyNotShell
+  - CISA AA22-277A
   asset_type: Endpoint
   confidence: 80
   context:
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index 0ef2da8938..c42b50cc98 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -40,6 +40,7 @@ tags:
   - Active Directory Lateral Movement
   - WhisperGate
   - Industroyer2
+  - CISA AA22-277A
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml
index 59fcabd767..df19829af4 100644
--- a/detections/endpoint/network_connection_discovery_netstat.yml
+++ b/detections/endpoint/network_connection_discovery_netstat.yml
@@ -25,6 +25,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - CISA AA22-277A
   confidence: 50
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml
index ebf5e23634..65fe2d20ec 100644
--- a/detections/endpoint/network_discovery_using_route_windows_app.yml
+++ b/detections/endpoint/network_discovery_using_route_windows_app.yml
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - CISA AA22-277A
   confidence: 30
   context:
   - Source:Endpoint
diff --git a/lookups/attacker_tools.csv b/lookups/attacker_tools.csv
index 834f72dd09..a872333478 100644
--- a/lookups/attacker_tools.csv
+++ b/lookups/attacker_tools.csv
@@ -25,4 +25,5 @@ NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Au
 ns.exe,A commonly used tool used by attackers to scan and map file shares
 SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
 kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks.
-advanced_port_scanner.exe, Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
\ No newline at end of file
+advanced_port_scanner.exe,Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
+mimikatz.exe,utility Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets.
\ No newline at end of file

From 8f9257f883a34e40a55a849a3f4306da72da4998 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sun, 9 Oct 2022 06:58:13 -0600
Subject: [PATCH 08/15] rename

---
 .../endpoint/exchange_powershell_abuse_via_ssrf.yml         | 4 ++--
 ...use.yml => windows_exchange_autodiscover_ssrf_abuse.yml} | 4 +++-
 ...ml => windows_exchange_autodiscover_ssrf_abuse.test.yml} | 6 +++---
 3 files changed, 8 insertions(+), 6 deletions(-)
 rename detections/web/{windows_exchange_autodiscover_abuse.yml => windows_exchange_autodiscover_ssrf_abuse.yml} (82%)
 rename tests/web/{windows_exchange_autodiscover_abuse.test.yml => windows_exchange_autodiscover_ssrf_abuse.test.yml} (69%)

diff --git a/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
index d5a456f636..666fed4664 100644
--- a/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
+++ b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: 'This analytic identifies suspicious behavior related to ProxyShell against
-  on-premise Microsoft Exchange servers. \
+  on-premise Microsoft Exchange servers. This analytic has been replaced by GUID d436f9e7-0ee7-4a47-864b-6dea2c4e2752 which utilizes the Web Datamodel. \
 
   Modification of this analytic is requried to ensure fields are mapped accordingly.
   \
@@ -20,7 +20,7 @@ description: 'This analytic identifies suspicious behavior related to ProxyShell
 
   Review the source attempting to perform this activity against your environment.
   In addition, review PowerShell logs and access recently granted to Exchange roles.'
-search: '`exchange` c_uri="*//autodiscover.json*" cs_uri_query="*PowerShell*" cs_method="POST"
+search: '`exchange` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
   | stats count min(_time) as firstTime max(_time) as lastTime by dest, cs_uri_query,
   cs_method, c_uri | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_abuse_via_ssrf_filter`'
diff --git a/detections/web/windows_exchange_autodiscover_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
similarity index 82%
rename from detections/web/windows_exchange_autodiscover_abuse.yml
rename to detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
index f70e70c6e9..93fe9260b7 100644
--- a/detections/web/windows_exchange_autodiscover_abuse.yml
+++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Web
-description: The following analytic utilizes the Web datamodel and identifies the ProxyShell or ProxyNotShell abuse. This analytic looks for the URI path and query of autodiscover, powershell and mapi along with a POST occurring. It will tally a simple score and show the output of the events that match.
+description: The following analytic utilizes the Web datamodel and identifies the ProxyShell or ProxyNotShell abuse. This vulnerability is a Server Side Request Forgery (SSRF) vulnerability, which is a web vulnerability that allows an adversary to exploit vulnerable functionality to access server side or local network services by affectively traversing the external firewall using vulnerable web functionality. This analytic looks for the URI path and query of autodiscover, powershell and mapi along with a POST occurring. It will tally a simple score and show the output of the events that match.
   This analytic may be added to by simply creating a new eval statement and modifying the hardcode digit for Score.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Web where (Web.status=200 OR Web.status=302 OR Web.status=401) AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method Web.uri_query
@@ -30,6 +30,8 @@ references:
   - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
   - https://research.splunk.com/stories/proxyshell/
   - https://docs.splunk.com/Documentation/AddOns/released/MSIIS
+  - https://highon.coffee/blog/ssrf-cheat-sheet/
+  - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
 tags:
   cve:
   - CVE-2021-34523
diff --git a/tests/web/windows_exchange_autodiscover_abuse.test.yml b/tests/web/windows_exchange_autodiscover_ssrf_abuse.test.yml
similarity index 69%
rename from tests/web/windows_exchange_autodiscover_abuse.test.yml
rename to tests/web/windows_exchange_autodiscover_ssrf_abuse.test.yml
index c51a91c062..ab1a4f18dc 100644
--- a/tests/web/windows_exchange_autodiscover_abuse.test.yml
+++ b/tests/web/windows_exchange_autodiscover_ssrf_abuse.test.yml
@@ -1,7 +1,7 @@
-name: Windows Exchange Autodiscover Abuse Unit Test
+name: Windows Exchange Autodiscover SSRF Abuse Unit Test
 tests:
-- name: Windows Exchange Autodiscover Abuse
-  file: web/windows_exchange_autodiscover_abuse.yml
+- name: Windows Exchange Autodiscover SSRF Abuse
+  file: web/windows_exchange_autodiscover_ssrf_abuse.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now

From b726e4b6854818361e9e6fb64f5f95b9bf5c1e65 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sun, 9 Oct 2022 07:09:29 -0600
Subject: [PATCH 09/15] Update detect_sharphound_file_modifications.yml

#2380
---
 .../endpoint/detect_sharphound_file_modifications.yml       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml
index e220634ee9..5b1eb1acd0 100644
--- a/detections/endpoint/detect_sharphound_file_modifications.yml
+++ b/detections/endpoint/detect_sharphound_file_modifications.yml
@@ -1,7 +1,7 @@
 name: Detect SharpHound File Modifications
 id: 42b4b438-beed-11eb-ba1d-acde48001122
-version: 1
-date: '2021-05-27'
+version: 2
+date: '2022-10-09'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -22,7 +22,7 @@ description: SharpHound is used as a reconnaissance collector, ingestor, for Blo
   `.ps1` ingestor will be PowerShell.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip",
-  "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json")
+  "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json", "*_ous.json", "*_containers.json")
   by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path
   Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`'

From df804a8343a5881d2fa1ad8b0ad70150147d457a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Sun, 9 Oct 2022 07:31:02 -0600
Subject: [PATCH 10/15] ProxyShell ProxyNotShell Behavior Detected

---
 ...yshell_proxynotshell_behavior_detected.yml | 61 +++++++++++++++++++
 ...l_proxynotshell_behavior_detected.test.yml | 13 ++++
 2 files changed, 74 insertions(+)
 create mode 100644 detections/web/proxyshell_proxynotshell_behavior_detected.yml
 create mode 100644 tests/web/proxyshell_proxynotshell_behavior_detected.test.yml

diff --git a/detections/web/proxyshell_proxynotshell_behavior_detected.yml b/detections/web/proxyshell_proxynotshell_behavior_detected.yml
new file mode 100644
index 0000000000..8e4774394d
--- /dev/null
+++ b/detections/web/proxyshell_proxynotshell_behavior_detected.yml
@@ -0,0 +1,61 @@
+name: ProxyShell ProxyNotShell Behavior Detected
+id: c32fab32-6aaf-492d-bfaf-acbed8e50cdf
+version: 1
+date: '2022-10-03'
+author: Michael Haag, Splunk
+type: Correlation
+datamodel:
+  - Risk
+description: The following correlation will identify activity related to Windows Exchange being actively exploited by adversaries related to ProxyShell or ProxyNotShell. In addition, the analytic correlates post-exploitation Cobalt Strike analytic story. Common post-exploitation behavior has been seen in the wild includes adversaries running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically looks for 5 distict analyticstories to trigger, modify or tune as needed for your organization.
+  5 analytic stories is an arbitrary number but was chosen to reduce the amount of noise but also require the 3 analytic stories to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.analyticstories) as analyticstories values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count dc(All_Risk.analyticstories) as dc_analyticstories from datamodel=Risk.All_Risk where All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell", "Cobalt Strike")   All_Risk.risk_object_type="system" by _time span=1h All_Risk.risk_object All_Risk.risk_object_type 
+  | `drop_dm_object_name(All_Risk)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | where dc_analyticstories >= 5
+  | `proxyshell_proxynotshell_behavior_detected_filter`'
+how_to_implement: To implement this correlation, you will need to enable ProxyShell, ProxyNotShell and Cobalt Strike analytic stories (the anaytics themselves) and ensure proper data is being collected for Web and Endpoint datamodels. Run the correlation rule seperately to validate it is not triggering too much or generating incorrectly. Validate by running ProxyShell POC code and Cobalt Strike behavior. 
+known_false_positives: False positives will be limited, however tune or modify the query as needed.
+references:
+  - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
+  - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
+tags:
+  analytic_story:
+  - ProxyShell
+  - ProxyNotShell
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Scope:Network
+  - Scope:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/proxyshell/proxyshell-risk.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: ProxyShell or ProxyNotShell activity has been identified on $risk_object$.
+  mitre_attack_id:
+  - T1190
+  nist:
+  - DE.CM
+  observable:
+  - name: risk_object
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - All_Risk.analyticstories
+  - All_Risk.risk_object_type
+  - All_Risk.risk_object
+  - All_Risk.annotations.mitre_attack.mitre_tactic
+  - source
+  risk_score: 81
+  security_domain: network
diff --git a/tests/web/proxyshell_proxynotshell_behavior_detected.test.yml b/tests/web/proxyshell_proxynotshell_behavior_detected.test.yml
new file mode 100644
index 0000000000..699a1023e1
--- /dev/null
+++ b/tests/web/proxyshell_proxynotshell_behavior_detected.test.yml
@@ -0,0 +1,13 @@
+name: ProxyShell ProxyNotShell Behavior Detected Unit Test
+tests:
+- name: ProxyShell ProxyNotShell Behavior Detected
+  file: web/proxyshell_proxynotshell_behavior_detected.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: proxyshell-risk.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/proxyshell/proxyshell-risk.log
+    source: proxyshell
+    sourcetype: stash
+    update_timestamp: true

From 46a125d20b6297057e56d7f2a6339d1330f01524 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 10 Oct 2022 09:48:59 -0600
Subject: [PATCH 11/15] Update windows_exchange_autodiscover_ssrf_abuse.yml

---
 detections/web/windows_exchange_autodiscover_ssrf_abuse.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
index 93fe9260b7..95004dda54 100644
--- a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
+++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
@@ -1,4 +1,4 @@
-name: Windows Exchange Autodiscover Abuse
+name: Windows Exchange Autodiscover SSRF Abuse
 id: d436f9e7-0ee7-4a47-864b-6dea2c4e2752
 version: 1
 date: '2022-10-03'
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | where Score >= 2
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
-  | `windows_exchange_autodiscover_abuse_filter`'
+  | `windows_exchange_autodiscover_ssrf_abuse_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed.
 known_false_positives: False positives are limited.
 references:

From 82387357ebaa609cc347b7816cda8402cc6e04ce Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 10 Oct 2022 10:09:11 -0600
Subject: [PATCH 12/15] Update proxyshell_proxynotshell_behavior_detected.yml

---
 detections/web/proxyshell_proxynotshell_behavior_detected.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/detections/web/proxyshell_proxynotshell_behavior_detected.yml b/detections/web/proxyshell_proxynotshell_behavior_detected.yml
index 8e4774394d..26eace0384 100644
--- a/detections/web/proxyshell_proxynotshell_behavior_detected.yml
+++ b/detections/web/proxyshell_proxynotshell_behavior_detected.yml
@@ -31,7 +31,6 @@ tags:
   confidence: 90
   context:
   - Scope:Network
-  - Scope:Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/proxyshell/proxyshell-risk.log
   impact: 90

From 8f3fbdfcbf0e638cdef26842b670a1743bb8ee9b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 10 Oct 2022 11:33:06 -0600
Subject: [PATCH 13/15] Update test_config_github_actions.json

---
 .../test_config_github_actions.json                      | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json
index 0872c356ea..318951c7d2 100644
--- a/bin/docker_detection_tester/test_config_github_actions.json
+++ b/bin/docker_detection_tester/test_config_github_actions.json
@@ -89,8 +89,13 @@
         "app_number": 3110,
         "app_version": "4.5.0",
         "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"
-    }
-  },
+    },
+    "SPLUNK_TA_FOR_IIS": {
+      "app_number": 3185,
+      "app_version": "1.2.0",
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz"
+  }
+ },
   "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
   "commit_hash": null,
   "container_tag": "latest",

From c9b12aa911a1a9a1d1869920b5c8a0a76349be1a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 10 Oct 2022 13:30:50 -0600
Subject: [PATCH 14/15] Update test_config_github_actions.json

---
 bin/docker_detection_tester/test_config_github_actions.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json
index 318951c7d2..a215a5dcbf 100644
--- a/bin/docker_detection_tester/test_config_github_actions.json
+++ b/bin/docker_detection_tester/test_config_github_actions.json
@@ -93,7 +93,7 @@
     "SPLUNK_TA_FOR_IIS": {
       "app_number": 3185,
       "app_version": "1.2.0",
-      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz"
+      "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-iis_120.tgz"
   }
  },
   "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",

From 3dde4162867ff5ab7137ea05f2788bb2fc54fdb4 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 10 Oct 2022 14:55:26 -0600
Subject: [PATCH 15/15] Update unified_messaging_service_spawning_a_process.yml

---
 .../endpoint/unified_messaging_service_spawning_a_process.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
index 1a18c5ac6f..3dca90a0f5 100644
--- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml
+++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
@@ -3,7 +3,7 @@ id: f1126df0-7bd5-11eb-988f-acde48001122
 version: 2
 date: '2022-10-03'
 author: Michael Haag, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This detection identifies Microsoft Exchange Server's Unified Messaging