Branch was auto-updated.

detections/endpoint/adsisearcher_account_discovery.yml

@@ -2,15 +2,14 @@ name: AdsiSearcher Account Discovery
 id: de7fcadc-04f3-11ec-a241-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a powershell command adsisearcher to do user
-  enumeration to the active directory. This command can be a normal query of a network
-  admin but since the output of this is not so much structure and cannot give a concrete
-  or specific information that admin may look upon this is still a good TTP to alert
-  some malicious activities.
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
+  for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
+  domain users for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*"
   Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
   by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -18,10 +17,11 @@ search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*ob
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: not commonly seen as a normal command from network admin but
-  possible noise may exist.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
+- https://attack.mitre.org/techniques/T1087/002/
 - https://www.blackhillsinfosec.com/red-blue-purple/
+- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/domain_account_discovery_with_dsquery.yml

@@ -2,14 +2,15 @@ name: Domain Account Discovery with Dsquery
 id: b1a8ce04-04c2-11ec-bea7-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious process commandline of dsquery
-  for enumerating users. This technique is commonly in attacker and red team to recon
-  on users in targetted machine. This command can also be used by network administrator
-  but not by a normal user.
+description: This analytic looks for the execution of `dsquery.exe` with command-line
+  arguments utilized to discover  domain users. The `user` argument returns a
+  list of all users registered in the domain. Red Teams and adversaries alike
+  engage in remote system discovery for situational awareness and Active Directory
+  Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe"
   AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process
@@ -20,10 +21,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network administrator may use this command but not commonly
-  seen used by a user.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+- https://attack.mitre.org/techniques/T1087/002/
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/domain_account_discovery_with_net_app.yml

@@ -2,14 +2,12 @@ name: Domain Account Discovery With Net App
 id: 98f6a534-04c2-11ec-96b2-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a process command line for AD discovery. This
-  techique is using the windows built in net.exe application to query AD users in
-  the targetted machine. This techique was seen in several malware as part of there
-  recon and can be a good pivot of analysis.
+description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users.
+ Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process
@@ -21,9 +19,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network operator can execute this command
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
+- https://attack.mitre.org/techniques/T1087/002/
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/domain_account_discovery_with_wmic.yml

@@ -2,14 +2,13 @@ name: Domain Account Discovery with Wmic
 id: 383572e0-04c5-11ec-bdcc-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a wmic command for enumerating user in active
-  directory. This technique was commonly used in pentesting, red-team and also by
-  some attacker to map all user in the targetted host. This search may also catch
-  this type of query made by network admin but not common in all the user in the network.
+description: This analytic looks for the execution of `wmic.exe` with command-line
+  arguments utilized to query for domain users. Red Teams and adversaries alike
+  use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe"
   AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process
@@ -22,9 +21,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network admin may execute this command for listing users.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
-- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+- https://attack.mitre.org/techniques/T1087/002/
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml

@@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
-  This command can be used by attacker to mapped all password policy in a target host.
-  This command may cause some noise especially in admin user that can execute this
-  for policy audit. This hunting query is a good pivot to start investigating possible
-  lateral movement or credential dumping as post attack.
+description: This analytic looks for the execution of `powershell.exe` executing the 
+  Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain.
+  Red Teams and adversaries alike may use PowerShell to enumerate domain policies
+  for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
@@ -22,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: network operator may use this command
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://attack.mitre.org/techniques/T1201/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml

@@ -2,15 +2,14 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
 id: 1ff7ccc8-065a-11ec-91e4-acde48001122
 version: 1
 date: '2021-08-26'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
-  This command can be used by attacker to mapped all password policy in a target host.
-  This command may cause some noise especially in admin user that can execute this
-  for policy audit. This hunting query is a good pivot to start investigating possible
-  lateral movement or credential dumping as post attack.
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain.
+  Red Teams and adversaries alike may use PowerShell to enumerate domain policies
+  for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -18,9 +17,11 @@ search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolic
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: network operator may use this command
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://attack.mitre.org/techniques/T1201/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_aduser_with_powershell.yml

@@ -2,15 +2,14 @@ name: Get ADUser with PowerShell
 id: 0b6ee3f4-04e3-11ec-a87d-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious commandline that commonly uses
-  for enumerating users in active directory. This  technique can be a good indicator
-  to hunt further TTPs to the machine to check further anomalies. Since this is a
-  hunt query expect some noise from administrator or some IT within the network that
-  may use this command.
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns
+  a list of all domain users. Red Teams and adversaries alike may use this commandlet
+  to identify remote systems for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*"
@@ -22,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network admin may use this command.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
-- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+- https://www.blackhillsinfosec.com/red-blue-purple/
+- https://attack.mitre.org/techniques/T1087/002/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps 
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_aduser_with_powershell_script_block.yml

@@ -2,15 +2,15 @@ name: Get ADUser with PowerShell Script Block
 id: 21432e40-04f4-11ec-b7e6-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This search is to detect a powershell command get-aduser function to
-  do user enumeration to the active directory. This command can be a normal query
-  of a network admin but since the output of this is not so much structure and cannot
-  give a concrete or specific information that admin may look upon this is still a
-  good TTP to alert some malicious activities.
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet
+  is used to return a list of all domain users. Red Teams and adversaries may leverage
+  this commandlet to enumerate domain groups for situational awareness and Active
+  Directory Discovery.
 search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -18,10 +18,11 @@ search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filte
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: network admin may use this command and other IT operator to
-  check AD users.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://www.blackhillsinfosec.com/red-blue-purple/
+- https://attack.mitre.org/techniques/T1087/002/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps 
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml

@@ -2,15 +2,14 @@ name: Get ADUserResultantPasswordPolicy with Powershell
 id: 8b5ef342-065a-11ec-b0fc-acde48001122
 version: 1
 date: '2021-08-26'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
-  This command can be used by attacker to mapped all password policy in a target host.
-  This command may cause some noise especially in admin user that can execute this
-  for policy audit. This hunting query is a good pivot to start investigating possible
-  lateral movement or credential dumping as post attack.
+description: This analytic looks for the execution of `powershell.exe` executing the 
+  Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain.
+  Red Teams and adversaries alike may use PowerShell to enumerate domain policies
+  for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*"
@@ -22,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: network operator or admin may use this command
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://attack.mitre.org/techniques/T1201/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml

@@ -2,15 +2,14 @@ name: Get ADUserResultantPasswordPolicy with Powershell Script Block
 id: 737e1eb0-065a-11ec-921a-acde48001122
 version: 1
 date: '2021-08-26'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, MAuricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
-  This command can be used by attacker to mapped all password policy in a target host.
-  This command may cause some noise especially in admin user that can execute this
-  for policy audit. This hunting query is a good pivot to start investigating possible
-  lateral movement or credential dumping as post attack.
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain.
+  Red Teams and adversaries alike may use PowerShell to enumerate domain policies
+  for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -18,9 +17,11 @@ search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolic
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: network operator may use this command
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://attack.mitre.org/techniques/T1201/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_domainpolicy_with_powershell.yml

@@ -2,14 +2,14 @@ name: Get DomainPolicy with Powershell
 id: b8f9947e-065a-11ec-aafb-acde48001122
 version: 1
 date: '2021-08-26'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a possible execution of powerview pentesting
-  tool for domain controller recon. This search look for function Get-DomainPolicy
-  to parse the domain policy of the targeted host. This TTP may be a good pivot to
-  look for credential dumping technique or lateral movement.
+description: This analytic looks for the execution of `powershell.exe` executing the 
+  `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain.
+  Red Teams and adversaries alike may use PowerShell to enumerate domain policies
+  for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*"
@@ -21,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: network operator or admin may use this command
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/
+- https://attack.mitre.org/techniques/T1201/
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_domainpolicy_with_powershell_script_block.yml

@@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a possible execution of powerview pentesting
-  tool for domain controller recon. This search look for function Get-DomainPolicy
-  to parse the domain policy of the targeted host. This TTP may be a good pivot to
-  look for credential dumping technique or lateral movement.
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain.
+  Red Teams and adversaries alike may use PowerShell to enumerate domain policies
+  for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: unknown
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/
+- https://attack.mitre.org/techniques/T1201/
 tags:
   analytic_story:
   - Active Directory Discovery

detections/endpoint/get_domainuser_with_powershell.yml

@@ -2,13 +2,15 @@ name: Get DomainUser with PowerShell
 id: 9a5a41d6-04e7-11ec-923c-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a cmdlet Get-DomainUser that are common on powerview
-  or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate
-  all users in active directory.
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView,
+  a PowerShell tool used to perform enumeration on Windows domains. Red Teams and
+  adversaries alike may leverage PowerView to enumerate domain users for situational
+  awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*"
@@ -20,7 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: unknown
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
 tags:

detections/endpoint/get_domainuser_with_powershell_script_block.yml

@@ -2,23 +2,22 @@ name: Get DomainUser with PowerShell Script Block
 id: 61994268-04f4-11ec-865c-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: his search is to detect a powershell command Get-DomainUser to do user
-  enumeration to the active directory. This command is function seen in powerspoit
-  and powerview tool that are designed to pentest active directory or domain controller
-  for possible attack. This is a good TTP for alerting SOC if there is a pentest or
-  recon happening on the system. try to look for lateral movement technique or credential
-  dumping techniques in the system.
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser`
+  is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
+  Red Teams and adversaries alike may use PowerView to enumerate domain users
+  for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: unknown
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
 tags:

detections/endpoint/getwmiobject_ds_user_with_powershell.yml

@@ -2,14 +2,16 @@ name: GetWmiObject DS User with PowerShell
 id: 22d3b118-04df-11ec-8fa3-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious execution wmi process that enumerate
-  user in active directory. This technique can be used by attacker and pentester to
-  mapped all the users as part of its recon to the targetted host. Network Admin may
-  seen executing this command but not often and also not common to see in user events.
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined
+  with the `-class ds_user` parameter can be used to return the full list of users
+  in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case,
+  using PowerShell, to enumerate domain users for situational awareness and Active
+  Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*"
@@ -22,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network admin may execute this command.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
 tags:

detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml

@@ -2,15 +2,15 @@ name: GetWmiObject DS User with PowerShell Script Block
 id: fabd364e-04f3-11ec-b34b-acde48001122
 version: 1
 date: '2021-08-24'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a powershell command get-wmiobject function
-  to do user enumeration to the active directory. This command can be a normal query
-  of a network admin but since the output of this is not so much structure and cannot
-  give a concrete or specific information that admin may look upon this is still a
-  good TTP to alert some malicious activities.
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class
+  parameter leverages WMI to query for all domain users. Red Teams and adversaries
+  may leverage this commandlet to enumerate domain users for situational awareness
+  and Active Directory Discovery.
 search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*"
   Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
@@ -18,8 +18,7 @@ search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_
 how_to_implement: he following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: not commonly seen as a normal command from network admin but
-  possible noise may exist.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://www.blackhillsinfosec.com/red-blue-purple/
 - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace

detections/endpoint/password_policy_discovery_with_net.yml

@@ -2,15 +2,13 @@ name: Password Policy Discovery with Net
 id: 09336538-065a-11ec-8665-acde48001122
 version: 1
 date: '2021-08-26'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This search is to detect a net application command to discover password
-  policy. This commandline can be used by IT and admin to list all account domain
-  policy but also can be use by attacker as part of recon. this hunting query can
-  be a good pivot to locate credential dumping or lateral movement as part of post
-  attack.
+description: This analytic looks for the execution of `net.exe` or `net1.exe` 
+  with command line arguments used to obtain the domain password policy.
+  Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process
@@ -22,7 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: network operator or admin may use this command
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
 tags:

detections/endpoint/wmic_group_discovery.yml

@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: 'The follow hunting analytic identifies the use of `wmic.exe` enumerating
+description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating
   local groups on the endpoint. \
 
   Typically, by itself, is not malicious but may raise suspicion based on time of
@@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: False positives may be present. Tune as needed.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md