Branch was auto-updated.

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "4.1.0"
+      "version": "4.2.0"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-16T19:38:35 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -647,6 +647,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = Not all unauthenticated requests are malicious, but frequency, UA and source IPs and direct request to API provide context.
 providing_technologies = null
 
+[savedsearch://ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = This search looks for suspicious AWS AMI attribute modifications, such as sharing it with another AWS account or making the full AMI image public. Adversaries are known to abuse these APIs to exfiltrate sensitive organization information stored in the AWS Resources, there by its very important to monitor these seemingly benign API activity in Cloudtrail logs.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
 [savedsearch://ESCU - AWS Concurrent Sessions From Different Ips - Rule]
 type = detection
 asset_type = AWS Account
@@ -867,6 +877,26 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = There maybe buckets provisioned with S3 encryption
 providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
+[savedsearch://ESCU - AWS Disable Bucket Versioning - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = The following analytic detects AWS cloudtrail events where bucket versioning is suspended by a user. Versioning allows the AWS Administrators to maintain different version of the S3 bucket which can be used to recover deleted data. Adversaries have leveraged this technique in the wild during a ransomware incident to disable versioning so the client cannot recover the data.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["DE.AE"]}
+known_false_positives = It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
+[savedsearch://ESCU - AWS EC2 Snapshot Shared Externally - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
 [savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule]
 type = detection
 asset_type = AWS Account
@@ -927,6 +957,57 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = While this search has no known false positives.
 providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
+[savedsearch://ESCU - AWS Exfiltration via Anomalous GetObject API Activity - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search uses built in  Splunk command `| anomalydetection` to detect anomalies with respect to users making high number of GetObject API calls to download objects from S3 in a 10 minute time window. The field `probable_cause` is the name of the field that best explains why the event is anomalous. This command identifies anomalous events by computing a probability for each GetObject event by "count" "user_type" "user_arn" and detects anomaly based on the frequencies.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1119"], "nist": ["DE.AE"]}
+known_false_positives = It is possible that a user downloaded these files to use them locally and there are AWS services in configured that perform these activities for a legitimate reason. Filter is needed.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
+[savedsearch://ESCU - AWS Exfiltration via Batch Service - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1119"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that an AWS Administrator or a user has legitimately created this job for some tasks.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
+[savedsearch://ESCU - AWS Exfiltration via Bucket Replication - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = The following analytic detects API calls made to an S3 bucket when bucket replication services are enabled. S3 bucket replication is a feature offered by Amazon Web Services (AWS) that allows you to automatically and asynchronously copy data from one S3 bucket to another in the same or different region.\
+S3 bucket replication can also be used for cross-account replication, where data is replicated from a source bucket owned by one AWS account to a destination bucket owned by a different AWS account.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately implemented data replication to ensure data availability and improve data protection/backup strategies.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
+[savedsearch://ESCU - AWS Exfiltration via DataSync Task - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for potential misuse of an AWS service known as DataSync. This AWS service is used to transfer data between different AWS cloud storage services, such as Amazon S3, Amazon EFS, and Amazon FSx for Windows File Server. Attackers can create a task in AWS to periodically copy data from a private AWS location to a public location resulting in the compromise of the data.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1119"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the `sourceLocationArn` and `destinationLocationArn` of this task
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
+[savedsearch://ESCU - AWS Exfiltration via EC2 Snapshot - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = This search detects a series of AWS API calls, made in a short time window, related to EC2 snapshots that can detect a potential exfiltration via EC2 Snapshot modifications. In this attack, the attacker typically proceeds by listing and creating EC2 snapshots of the available EC2 instances followed by modifying snapshot attributes such that it can be shared externally. Once this is done, the attacker can then load that EC2 snapshot and access all the sensitive information.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We have intentionally removed `guardduty.amazonaws.com` from src_ip to remove false positives caused by guard duty. We recommend you adjust the time window as per your environment.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with an other account for a specific purpose. Please check any recent change requests filed in your organization.
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
+
 [savedsearch://ESCU - AWS High Number Of Failed Authentications For User - Rule]
 type = detection
 asset_type = AWS Account
@@ -1077,6 +1158,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event.
 providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
+[savedsearch://ESCU - AWS S3 Exfiltration Behavior Identified - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This correlation search looks at the risk events created by the detection analytics related Collection and Exfiltration techniques used by adversaries. The rule is designed to identify instances where 2 or more analytics unique AWS analytics and 2 or more distinct mitre IDs has triggered for a particular risk object. This alert when triggered may indicate a potential exfiltration in progress. By aggregating these analytics, security teams can swiftly respond to and investigate any suspicious activities, enhancing their ability to protect critical assets and prevent unauthorized access to sensitive information.
+how_to_implement = You must enable all the detection searches in the Data Exfiltration Analytic story to create risk events in Enterprise Security.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["DE.AE"]}
+known_false_positives = alse positives may be present based on automated tooling or system administrators. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule]
 type = detection
 asset_type = AWS Federated Account
@@ -1157,6 +1248,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Weaponization", "Expl
 known_false_positives = Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives.
 providing_technologies = null
 
+[savedsearch://ESCU - Azure AD Application Administrator Role Assigned - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the assignment of the Application Administrator role to an Azure AD user. Users in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. This role also grants the ability to manage application credentials. Users assigned this role can add credentials to an application, and use those credentials to impersonate the applications identity. If the applications identity has been granted access to a resource, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while impersonating the application. This ability to impersonate the applications identity may be an elevation of privilege over what the user can do via their role assignments. Red teams and adversaries alike may abuse this role to escalate their privileges in an Azure AD tenant.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may legitimately assign the Application Administrator role to a user. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Azure AD Authentication Failed During MFA Challenge - Rule]
 type = detection
 asset_type = Azure Active Directory
@@ -1191,7 +1292,7 @@ providing_technologies = null
 type = detection
 asset_type = Azure Active Directory
 confidence = medium
-explanation = The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
+explanation = The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence or escalate their privileges in an Azure AD environment.
 how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098.003"], "nist": ["DE.CM"]}
 known_false_positives = Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
@@ -1278,6 +1379,36 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Insta
 known_false_positives = Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
 providing_technologies = null
 
+[savedsearch://ESCU - Azure AD PIM Role Assigned - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the assignment of the Azure AD PIM role. Privileged Identity Management (PIM) is a service within Azure Azure AD that enables administrators to manage, control, and monitor access to sensitive resources. PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources. Once a user has been made eligible for an administrative role, she must activate this role assignment to perform the privileged actions. When a role is activated, Azure AD PIM temporarily adds active assignment for the role. While PIM can be leveraged as a powerful security control, it may also abused by adversaries to obtain privileged access. Security teams should monitor for the assignment and activation of PIM roles and validate their legitimacy.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
+known_false_positives = As part of legitimate administrative behavior, users may be assigned PIM roles. Filter as needed
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD PIM Role Assignment Activated - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the assignment of the Azure AD PIM role. Privileged Identity Management (PIM) is a service within Azure Azure AD that enables administrators to manage, control, and monitor access to sensitive resources. PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources. Once a user has been made eligible for an administrative role, she must activate this role assignment to perform the privileged actions. When a role is activated, Azure AD PIM temporarily adds active assignment for the role. While PIM can be leveraged as a powerful security control, it may also abused by adversaries to obtain privileged access. Security teams should monitor for the assignment and activation of PIM roles and validate their legitimacy.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
+known_false_positives = As part of legitimate administrative behavior, users may activate PIM roles. Filter as needed
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD Privileged Authentication Administrator Role Assigned - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the assignment of the Privileged Authentication Administrato role to an Azure AD user. Users in this role can set or reset authentication methods for any user in Azure Active Directory, including privileged roles like Global Administrators. Users with this role can change credentials for people who may have access to sensitive or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that users identity and permissions. Red teams and adversaries alike may abuse this role to escalate their privileges.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may legitimately assign the Privileged Authentication Administrator role as part of administrative tasks. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Azure AD Privileged Role Assigned - Rule]
 type = detection
 asset_type = Azure Active Directory
@@ -1288,6 +1419,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitr
 known_false_positives = Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed.
 providing_technologies = null
 
+[savedsearch://ESCU - Azure AD Privileged Role Assigned to Service Principal - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Azure AD Service Principal Created - Rule]
 type = detection
 asset_type = Azure Active Directory
@@ -1302,7 +1443,7 @@ providing_technologies = null
 type = detection
 asset_type = Azure Active Directory
 confidence = medium
-explanation = The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.
+explanation = The following analytic identifies the addition of new credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment. By compromising an account who is an Owner of an application with privileged access, attackers may also escalate their privileges in an Azure AD environment by adding new credentials and logging in as the service principal.
 how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.001"], "nist": ["DE.CM"]}
 known_false_positives = Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
@@ -1312,7 +1453,7 @@ providing_technologies = null
 type = detection
 asset_type = Azure Active Directory
 confidence = medium
-explanation = The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+explanation = The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. Attackers who are looking to escalate their privileges by leveraging a Service Principals permissions may also add a new owner.
 how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
 known_false_positives = Administrator may legitimately add new owners for Service Principals. Filter as needed.
@@ -1644,16 +1785,6 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour
 providing_technologies = null
 
-[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
-type = detection
-asset_type = EC2 Snapshot
-confidence = medium
-explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
-how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
-annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["DE.CM"]}
-known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
-providing_technologies = ["Amazon Web Services - Cloudtrail"]
-
 [savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
 type = detection
 asset_type = AWS Instance
@@ -2180,6 +2311,16 @@ annotations = {"cis20": ["CIS 13"], "nist": ["DE.AE"]}
 known_false_positives = It's possible that a user has legitimately deleted a network ACL.
 providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
+[savedsearch://ESCU - Detect Activity Related to Pass the Hash Attacks - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts.
+how_to_implement = To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.002"], "nist": ["DE.AE"]}
+known_false_positives = Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate.
+providing_technologies = ["Microsoft Windows"]
+
 [savedsearch://ESCU - Detect API activity from users without MFA - Rule]
 type = detection
 asset_type = AWS Instance
@@ -3551,16 +3692,6 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
-[savedsearch://ESCU - Detect Activity Related to Pass the Hash Attacks - Rule]
-type = detection
-asset_type = Endpoint
-confidence = medium
-explanation = This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique.
-how_to_implement = To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows.
-annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.002"], "nist": ["DE.CM"]}
-known_false_positives = Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate.
-providing_technologies = ["Microsoft Windows"]
-
 [savedsearch://ESCU - Detect AzureHound Command-Line Arguments - Rule]
 type = detection
 asset_type = Endpoint
@@ -9309,10 +9440,10 @@ providing_technologies = ["Microsoft Windows"]
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller.
+explanation = This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. AdFind.exe is a powerful tool that is commonly used for querying and retrieving information from Active Directory (AD). While it is primarily designed for AD administration and management, it has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["DE.CM"]}
-known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons
+known_false_positives = ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule]
@@ -11005,6 +11136,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_at
 known_false_positives = False positives should be limited, however filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows PaperCut NG Spawn Shell - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is designed to detect instances where the PaperCut NG application (pc-app.exe) spawns a Windows shell, specifically cmd.exe or PowerShell. This behavior may indicate potential malicious activity, such as an attacker attempting to gain unauthorized access or execute harmful commands on the affected system.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1059", "T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present, but most likely not. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Password Managers Discovery - Rule]
 type = detection
 asset_type = Endpoint
@@ -11379,13 +11520,23 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = False positives will be present, filter as needed or restrict to critical assets on the perimeter.
 providing_technologies = null
 
+[savedsearch://ESCU - Windows Registry BootExecute Modification - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic monitors the BootExecute registry key for any modifications from its default value, which could indicate potential malicious activity. The BootExecute registry key, located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager, manages the list of applications and services that are executed during system boot. By default, the BootExecute value is set to "autocheck autochk *". Attackers might attempt to modify this value to achieve persistence, load malicious code, or tamper with the system's boot process.
+how_to_implement = To successfully implement this search you need to be ingesting information on Windows Registry that include the name of the path and key responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1542", "T1547.001"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present and will need to be filtered.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Registry Certificate Added - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
 explanation = The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to (SetValue) when a new certificate is added. The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "<THUMBPRINT_VALUE>\Blob" as this indicates the direct installation or modification of a root certificate binary blob. The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["DE.CM"]}
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["DE.AE"]}
 known_false_positives = False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
@@ -11749,6 +11900,46 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = Network administrator may disable this services as part of its audit process within the network. Filter is needed.
 providing_technologies = null
 
+[savedsearch://ESCU - Windows Snake Malware File Modification Crmlog - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identfies a .crmlog written to windows\registration. Per the report, typically, this file has been found within the %windows%\Registration directory with the format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog and is decrypted by Snake's kernel driver.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Snake Malware Kernel Driver Comadmin - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the comadmin.dat file written to disk, which is related to Snake Malware. From the report, Snakes installer drops the kernel driver and a custom DLL which is used to load the driver into a single AES encrypted file on disk. Typically, this file is named comadmin.dat and is stored in the %windows%\system32\Com directory.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.006"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present, filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Snake Malware Registry Modification wav OpenWithProgIds - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The follow analytic identifies the registry being modified at .wav\\OpenWithProgIds\, which is related to the Snake Malware campaign. Upon execution, Snake's WerFault.exe will attempt to decrypt an encrypted blob within the Windows registry that is typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake's kernel driver and kernel driver loader.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present and will require tuning based on program Ids in large organizations.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Snake Malware Service Create - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a new service WerFaultSvc being created with a binary path located in the windows winsxs path. Per the report, the Snake version primarily discussed in this advisory registers a service to maintain persistence on a system. Typically this service is named WerFaultSvc which we assess was used to blend in with the legitimate Windows service WerSvc. On boot, this service will execute Snakes WerFault.exe, which Snake developers chose to hide among the numerous valid Windows WerFault.exe files in the windows WinSxS directory. Executing WerFault.exe will start the process of decrypting Snakes components and loading them into memory.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.006", "T1569.002"], "nist": ["DE.CM"]}
+known_false_positives = False positives should be limited as this is a strict primary indicator used by Snake Malware.
+providing_technologies = null
+
 [savedsearch://ESCU - Windows Spearphishing Attachment Connect To None MS Office Domain - Rule]
 type = detection
 asset_type = Endpoint
@@ -12133,6 +12324,18 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Installation", "Explo
 known_false_positives = False positives will be present. Drill down into the driver further by version number and cross reference by signer. Review the reference material in the lookup. In addition, modify the query to look within specific paths, which will remove a lot of "normal" drivers.
 providing_technologies = null
 
+[savedsearch://ESCU - Windows WinLogon with Public Network Connection - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is designed to detect anomalous behavior associated with the BlackLotus Campaign, a sophisticated bootkit attack reported by ESET and further investigated in a blog by Microsoft, which provided hunting queries for security analysts. The primary focus of this analytic is to identify instances of Winlogon.exe, a critical Windows process, connecting to public IP space, which is indicative of potential malicious activity.\ The BlackLotus Campaign is a bootkit-based attack that compromises system integrity by infecting the Master Boot Record (MBR) and Volume Boot Record (VBR). This malware variant can bypass traditional security measures, load before the operating system, and maintain persistence on the target system.\
+Winlogon.exe is a critical Windows process responsible for managing user logon and logoff processes. Under normal circumstances, Winlogon.exe should not be connecting to public IP addresses. However, if it does, it may indicate that the process has been compromised as part of the BlackLotus Campaign or another malicious operation.\
+This analytic monitors network connections made by Winlogon.exe and triggers an alert if it detects connections to public IP space. By identifying such anomalous behavior, security analysts can investigate further and respond swiftly to potential threats.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and Network_Traffic datamodel under All Traffic. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1542.003"], "nist": ["DE.AE"]}
+known_false_positives = False positives will be present and filtering will be required. Legitimate IPs will be present and need to be filtered.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows WMI Impersonate Token - Rule]
 type = detection
 asset_type = Endpoint
@@ -12380,6 +12583,16 @@ annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitr
 known_false_positives = unknown
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - PaperCut NG Suspicious Behavior Debug Log - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The following hunting analytic is designed to monitor and detect potential exploitation attempts targeting a PaperCut NG server by analyzing its debug log data. By focusing on public IP addresses accessing the PaperCut NG instance, this analytic aims to identify unauthorized or suspicious access attempts. Furthermore, it searches for specific URIs that have been discovered in the proof of concept code, which are associated with known exploits or vulnerabilities. The analytic is focused on the user admin. Regex is used mainly because the log is not parsed by Splunk and there is no TA for this debug log.
+how_to_implement = Debug logs must be enabled and shipped to Splunk in order to properly identify behavior with this analytic.
+annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"]}
+known_false_positives = False positives may be present, as this is based on the admin user accessing the Papercut NG instance from a public IP address. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Detect ARP Poisoning - Rule]
 type = detection
 asset_type = Infrastructure
@@ -12936,6 +13149,16 @@ annotations = {"cis20": ["CIS 13"], "nist": ["DE.CM"]}
 known_false_positives = None at this time
 providing_technologies = null
 
+[savedsearch://ESCU - PaperCut NG Remote Web Access Attempt - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The following analytic is designed to detect potential exploitation attempts on publicly accessible PaperCut NG servers. It identifies connections from public IP addresses to the server and specifically monitors for URI paths commonly found in proof-of-concept (POC) scripts for exploiting PaperCut NG vulnerabilities. These URI paths have been observed in both Metasploit modules and standalone scripts used for attacking PaperCut NG servers. When a public IP address is detected accessing one or more of these suspicious URI paths, an alert may be generated to notify the security team of the potential threat. The team can then investigate the source IP address, the targeted PaperCut NG server, and any other relevant information to determine the nature of the activity and take appropriate actions to mitigate the risk.
+how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present, filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule]
 type = detection
 asset_type = Web Server
@@ -13103,7 +13326,7 @@ version = 3
 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html", "http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco"]
 maintainers = [{"company": "Mauricio Velazco Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Active Directory Lateral Movement Identified - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Impacket Lateral Movement smbexec CommandLine Parameters - Rule", "ESCU - Impacket Lateral Movement WMIExec Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell Invoke CIMMethod CIMSession - Rule", "ESCU - PowerShell Start or Stop Service - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule", "ESCU - Windows Enable Win32 ScheduledJob via Registry - Rule", "ESCU - Windows Large Number of Computer Service Tickets Requested - Rule", "ESCU - Windows Local Administrator Credential Stuffing - Rule", "ESCU - Windows PowerShell Get CIMInstance Remote Computer - Rule", "ESCU - Windows PowerShell WMI Win32 ScheduledJob - Rule", "ESCU - Windows Rapid Authentication On Multiple Hosts - Rule", "ESCU - Windows RDP Connection Successful - Rule", "ESCU - Windows Remote Create Service - Rule", "ESCU - Windows Service Create with Tscon - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
+searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Active Directory Lateral Movement Identified - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Impacket Lateral Movement smbexec CommandLine Parameters - Rule", "ESCU - Impacket Lateral Movement WMIExec Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell Invoke CIMMethod CIMSession - Rule", "ESCU - PowerShell Start or Stop Service - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Windows Administrative Shares Accessed On Multiple Hosts - Rule", "ESCU - Windows Enable Win32 ScheduledJob via Registry - Rule", "ESCU - Windows Large Number of Computer Service Tickets Requested - Rule", "ESCU - Windows Local Administrator Credential Stuffing - Rule", "ESCU - Windows PowerShell Get CIMInstance Remote Computer - Rule", "ESCU - Windows PowerShell WMI Win32 ScheduledJob - Rule", "ESCU - Windows Rapid Authentication On Multiple Hosts - Rule", "ESCU - Windows RDP Connection Successful - Rule", "ESCU - Windows Remote Create Service - Rule", "ESCU - Windows Service Create with Tscon - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - Windows Special Privileged Logon On Multiple Hosts - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage.
 narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
 Indications of lateral movement in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\
@@ -13328,10 +13551,24 @@ version = 1
 references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://attack.mitre.org/tactics/TA0003/", "https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
-searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"]
+searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD PIM Role Assigned - Rule", "ESCU - Azure AD PIM Role Assignment Activated - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"]
 description = Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.
 narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants. 
 
+[analytic_story://Azure Active Directory Privilege Escalation]
+category = Adversary Tactics
+last_updated = 2023-04-24
+version = 1
+references = ["https://attack.mitre.org/tactics/TA0003/", "https://cloudbrothers.info/en/azure-attack-paths/", "https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/PrivEsc/", "https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
+spec_version = 3
+searches = ["ESCU - Azure AD Application Administrator Role Assigned - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD PIM Role Assigned - Rule", "ESCU - Azure AD PIM Role Assignment Activated - Rule", "ESCU - Azure AD Privileged Authentication Administrator Role Assigned - Rule", "ESCU - Azure AD Privileged Role Assigned to Service Principal - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule"]
+description = Monitor for activities and techniques associated with Privilege Escalation attacks within Azure Active Directory tenants.
+narrative = Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations or vulnerabilities.\
+Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365 and Microsoft Teams. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\
+Privilege escalation attacks in Azure AD typically involve abusing  misconfigurations to gain elevated privileges, such as Global Administrator access. Once an attacker has escalated their privileges and taken full control of a tenant, they may abuse every service that leverages Azure AD including moving laterally to Azure virtual machines to access sensitive data and carry out further attacks. Security teams should monitor for privilege escalation attacks in Azure Active Directory to identify breaches before attackers achieve operational success.\
+The following analytic story groups detection opportunities that seek to identify an adversary attempting to escalate privileges in Azure AD tenants.
+
 [analytic_story://Baron Samedit CVE-2021-3156]
 category = Adversary Tactics
 last_updated = 2021-01-27
@@ -13372,7 +13609,7 @@ version = 1
 references = ["https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/", "https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Windows BootLoader Inventory - Rule", "ESCU - Windows Impair Defenses Disable HVCI - Rule"]
+searches = ["ESCU - Windows BootLoader Inventory - Rule", "ESCU - Windows Impair Defenses Disable HVCI - Rule", "ESCU - Windows WinLogon with Public Network Connection - Rule"]
 description = The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality
 narrative = The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn't gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature  UEFI Secure Boot  is now a reality. present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022. (ESET, 2023) The following content aims to aid defenders in detecting suspicious bootloaders and understanding the diverse techniques employed in this campaign.
 
@@ -13635,7 +13872,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0010/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule", "ESCU - AWS Disable Bucket Versioning - Rule", "ESCU - AWS EC2 Snapshot Shared Externally - Rule", "ESCU - AWS Exfiltration via Anomalous GetObject API Activity - Rule", "ESCU - AWS Exfiltration via Batch Service - Rule", "ESCU - AWS Exfiltration via Bucket Replication - Rule", "ESCU - AWS Exfiltration via DataSync Task - Rule", "ESCU - AWS Exfiltration via EC2 Snapshot - Rule", "ESCU - AWS S3 Exfiltration Behavior Identified - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
 description = The stealing of data by an adversary.
 narrative = Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command And Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.
 
@@ -14428,6 +14665,20 @@ Awareness of the Orangeworm group first surfaced in January, 2015. It has conduc
 Healthcare may be a promising target, because it is notoriously behind in technology, often using older operating systems and neglecting to patch computers. Even so, the group was able to evade detection for a full three years. Sources say that the malware spread quickly within the target networks, infecting computers used to control medical devices, such as MRI and X-ray machines.\
 This Analytic Story is designed to help you detect and investigate suspicious activities that may be indicative of an Orangeworm attack. One detection search looks for command-line arguments. Another monitors for uses of sc.exe, a non-essential Windows file that can manipulate Windows services. One of the investigative searches helps you get more information on web hosts that you suspect have been compromised.
 
+[analytic_story://PaperCut MF NG Vulnerability]
+category = Adversary Tactics
+last_updated = 2023-05-15
+version = 1
+references = ["https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability", "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219", "https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/", "https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/", "https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Windows PaperCut NG Spawn Shell - Rule", "ESCU - PaperCut NG Suspicious Behavior Debug Log - Rule", "ESCU - PaperCut NG Remote Web Access Attempt - Rule"]
+description = The FBI has issued a joint advisory concerning the exploitation of a PaperCut MF/NG vulnerability (CVE-2023-27350) by malicious actors, which began in mid-April 2023 and has been ongoing. In early May 2023, a group identifying themselves as the Bl00dy Ransomware Gang targeted vulnerable PaperCut servers within the Education Facilities Subsector. The advisory provides information on detecting exploitation attempts and shares known indicators of compromise (IOCs) associated with the group's activities.
+narrative = PaperCut MF/NG versions 19 and older have reached their end-of-life, as documented on the End of Life Policy page. Customers using these older versions are advised to purchase an updated license online for PaperCut NG or through their PaperCut Partner for PaperCut MF. For users with a currently supported version (version 20 or later), they can upgrade to any maintenance release version they are licensed for.\ If upgrading to a security patch is not possible, there are alternative options to enhance security. Users can lock down network access to their server(s) by blocking all inbound traffic from external IPs to the web management port (port 9191 and 9192 by default) and blocking all inbound traffic to the web management portal on the firewall to the server. Additionally, users can apply "Allow list" restrictions under Options > Advanced > Security > Allowed site server IP addresses, setting this to only allow the IP addresses of verified Site Servers on their network.\
+The vulnerabilities CVE-2023-27350 and CVE-2023-27351 have CVSS scores of 9.8 (Critical) and 8.2 (High), respectively. PaperCut and its partner network have activated response teams to assist PaperCut MF and NG customers, with service desks available 24/7 via their support page. The security response team at PaperCut has been working with external security advisors to compile a list of unpatched PaperCut MF/NG servers that have ports open on the public internet. They have been proactively reaching out to potentially exposed customers since Wednesday afternoon (AEST) and are working around the clock through the weekend.\
+The exploit was first detected in the wild on April 18th, 2023, at 03:30 AEST / April 17th, 2023, at 17:30 UTC. The earliest signature of suspicious activity on a customer server potentially linked to this vulnerability dates back to April 14th, 2023, at 01:29 AEST / April 13th, 2023, at 15:29 UTC.\
+Applying the security fixes should not have any negative impact. Users can follow their usual upgrade procedure to obtain the upgrade. Additional links on the -Check for updates- page (accessed through the Admin interface > About > Version info > Check for updates) allow customers to download fixes for previous major versions that are still supported (e.g., 20.1.7 and 21.2.11) as well as the current version available. PaperCut MF users are advised to follow their regular upgrade process and consult their PaperCut partner or reseller for assistance.
+
 [analytic_story://PetitPotam NTLM Relay on Active Directory Certificate Services]
 category = Adversary Tactics
 last_updated = 2021-08-31
@@ -14745,6 +14996,17 @@ searches = ["ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicio
 description = Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.
 narrative = Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party Caffiliates or pay-per-install (PPI) partners, typically seen as commodity adware/malware. Additional indicators and behaviors may be found within the references.
 
+[analytic_story://Snake Malware]
+category = Adversary Tactics
+last_updated = 2023-05-10
+version = 1
+references = ["https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Snake Malware File Modification Crmlog - Rule", "ESCU - Windows Snake Malware Kernel Driver Comadmin - Rule", "ESCU - Windows Snake Malware Registry Modification wav OpenWithProgIds - Rule", "ESCU - Windows Snake Malware Service Create - Rule"]
+description = The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive targets.
+narrative = The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive targets. To conduct operations using this tool, the FSB created a covert peer-to-peer (P2P) network of numerous Snake-infected computers worldwide. Many systems in this P2P network serve as relay nodes which route disguised operational traffic to and from Snake implants on the FSB's ultimate targets. Snake's custom communications protocols employ encryption and fragmentation for confidentiality and are designed to hamper detection and collection efforts. We consider Snake to be the most sophisticated cyber espionage tool in the FSB's arsenal. The sophistication of Snake stems from three principal areas. First, Snake employs means to achieve a rare level of stealth in its host components and network communications. Second, Snake's internal technical architecture allows for easy incorporation of new or replacement components. This design also facilitates the development and interoperability of Snake instances running on different host operating systems. We have observed interoperable Snake implants for Windows, MacOS, and Linux operating systems. Lastly, Snake demonstrates careful software engineering design and implementation, with the implant containing surprisingly few bugs given its complexity. (CISA, 2023)
+
 [analytic_story://Sneaky Active Directory Persistence Tricks]
 category = Adversary Tactics
 last_updated = 2022-08-29
@@ -14829,16 +15091,16 @@ narrative = It is important to monitor and control who has access to your AWS in
 
 [analytic_story://Suspicious AWS S3 Activities]
 category = Cloud Security
-last_updated = 2018-07-24
-version = 2
-references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
+last_updated = 2023-04-24
+version = 3
+references = ["https://github.com/nagwww/s3-leaks", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/", null]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
-description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
-narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
-Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
-Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.   
+searches = ["ESCU - AWS Disable Bucket Versioning - Rule", "ESCU - AWS Exfiltration via Bucket Replication - Rule", "ESCU - AWS Exfiltration via DataSync Task - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+description = Use the searches in this Analytic Story using Cloudtrail logs to to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP, permission and policy updates to the bucket, potential misuse of other services leading to data being leaked.
+narrative = One of the most common ways that attackers attempt to steal data from S3 is by gaining unauthorized access to S3 buckets and copying or exfiltrating data to external locations.\
+However, suspicious S3 activities can refer to any unusual behavior detected within an Amazon Web Services (AWS) Simple Storage Service (S3) bucket, including unauthorized access, unusual data transfer patterns, and access attempts from unknown IP addresses. \
+It is important for organizations to regularly monitor S3 activities for suspicious behavior and implement security best practices, such as using access controls, encryption, and strong authentication mechanisms, to protect sensitive data stored within S3 buckets. By staying vigilant and taking proactive measures, organizations can help prevent potential security breaches and minimize the impact of attacks if they do occur.
 
 [analytic_story://Suspicious AWS Traffic]
 category = Cloud Security
@@ -14873,7 +15135,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - AWS AMI Atttribute Modification for Exfiltration - Rule", "ESCU - AWS EC2 Snapshot Shared Externally - Rule", "ESCU - AWS Exfiltration via EC2 Snapshot - Rule", "ESCU - AWS S3 Exfiltration Behavior Identified - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
 
@@ -15183,6 +15445,17 @@ searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - Attem
 description = This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more.
 narrative = WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques.
 
+[analytic_story://Windows BootKits]
+category = Adversary Tactics
+last_updated = 2023-05-03
+version = 1
+references = ["https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/", "https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Windows BootLoader Inventory - Rule", "ESCU - Windows Registry BootExecute Modification - Rule"]
+description = Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
+narrative = A bootkit is a sophisticated type of malware that targets the boot sectors of a hard drive, specifically the Master Boot Record (MBR) and Volume Boot Record (VBR). The MBR is the initial section of the disk that is loaded following the hardware initialization process executed by the Basic Input/Output System (BIOS). It houses the boot loader, which is responsible for loading the operating system. In contrast, the VBR is located at the beginning of each partition and contains the boot code for that specific partition. When an adversary gains raw access to the boot drive, they can overwrite the MBR or VBR, effectively diverting the execution during startup from the standard boot loader to the malicious code injected by the attacker. This tampering allows the malware to load before the operating system, enabling it to execute malicious activities stealthily and maintain persistence on the compromised system. Bootkits are particularly dangerous because they can bypass security measures implemented by the operating system and antivirus software. Since they load before the operating system, they can easily evade detection and manipulate the system's behavior from the earliest stages of the boot process. This capability makes bootkits a potent tool in an attacker's arsenal for gaining unauthorized access, stealing sensitive information, or launching further attacks on other systems. To defend against bootkit attacks, organizations should implement multiple layers of security, including strong endpoint protection, regular software updates, user awareness training, and monitoring for unusual system behavior. Additionally, hardware-based security features, such as Unified Extensible Firmware Interface (UEFI) Secure Boot and Trusted Platform Module (TPM), can help protect the integrity of the boot process and reduce the risk of bootkit infections.
+
 [analytic_story://Windows Certificate Services]
 category = Adversary Tactics
 last_updated = 2023-02-01

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 13737
+build = 14080
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.1.0
+version = 4.2.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-16T19:38:35 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 4.1.0
+version = 4.2.0

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-16T19:38:35 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-16T19:38:35 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -253,6 +253,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_ami_atttribute_modification_for_exfiltration_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_concurrent_sessions_from_different_ips_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -341,6 +345,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_disable_bucket_versioning_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_ec2_snapshot_shared_externally_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_ecr_container_scanning_findings_high_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -365,6 +377,26 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_exfiltration_via_anomalous_getobject_api_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_exfiltration_via_batch_service_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_exfiltration_via_bucket_replication_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_exfiltration_via_datasync_task_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_exfiltration_via_ec2_snapshot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_high_number_of_failed_authentications_for_user_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -425,6 +457,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_s3_exfiltration_behavior_identified_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_saml_access_by_provider_user_and_principal_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -457,6 +493,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_application_administrator_role_assigned_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_authentication_failed_during_mfa_challenge_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -505,10 +545,26 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_pim_role_assigned_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_pim_role_assignment_activated_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_privileged_authentication_administrator_role_assigned_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_privileged_role_assigned_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_privileged_role_assigned_to_service_principal_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_service_principal_created_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -649,10 +705,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[detect_shared_ec2_snapshot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -861,6 +913,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_activity_related_to_pass_the_hash_attacks_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_api_activity_from_users_without_mfa_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1397,10 +1453,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[detect_activity_related_to_pass_the_hash_attacks_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [detect_azurehound_command_line_arguments_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4317,6 +4369,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_papercut_ng_spawn_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_password_managers_discovery_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4465,6 +4521,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_registry_bootexecute_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_registry_certificate_added_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4613,6 +4673,22 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_snake_malware_file_modification_crmlog_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_snake_malware_kernel_driver_comadmin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_snake_malware_registry_modification_wav_openwithprogids_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_snake_malware_service_create_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4757,6 +4833,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_winlogon_with_public_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_wmi_impersonate_token_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4853,6 +4933,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[papercut_ng_suspicious_behavior_debug_log_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_arp_poisoning_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5057,6 +5141,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[papercut_ng_remote_web_access_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [proxyshell_proxynotshell_behavior_detected_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -5362,6 +5450,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[papercutng]
+definition = sourcetype="papercutng"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [path_traversal_spl_injection]
 definition = index=_internal sourcetype=splunkd_ui_access
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-16T19:38:35 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-05-02T22:09:51 UTC
+# On Date: 2023-05-16T19:38:35 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/lookups/privileged_azure_ad_roles.csv

@@ -1,5 +1,4 @@
 azureadrole,isprvilegedadrole,description
-"""Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps.
 """Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user.
 """Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
 """Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices.
@@ -18,7 +17,6 @@ azureadrole,isprvilegedadrole,description
 """License Administrator""",True,Can manage product licenses on users and groups.
 """Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
 """Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators.
-"""Privileged Authentication Administrator""",True,Can access to view, set and reset authentication method information for any user (admin or non-admin).
 """Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.
 """Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365.
 """SharePoint Administrator""",True,Can manage all aspects of the SharePoint service.