From 79c86ce0fdd79295f68fd88c919b4f79b9fa22e1 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 16 Jun 2021 16:19:55 +0200
Subject: [PATCH 1/8] ssa

---
 .../ssa___wevtutil_usage_to_clear_logs.yml    | 52 +++++++++++++++++++
 .../ssa___wevtutil_usage_to_disable_logs.yml  | 47 +++++++++++++++++
 ...sa___wevtutil_usage_to_clear_logs.test.yml | 14 +++++
 ...___wevtutil_usage_to_disable_logs.test.yml | 10 ++++
 4 files changed, 123 insertions(+)
 create mode 100644 detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
 create mode 100644 detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
 create mode 100644 tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
 create mode 100644 tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml

diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
new file mode 100644
index 0000000000..5431ba232a
--- /dev/null
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -0,0 +1,52 @@
+name: WevtUtil Usage To Clear Logs
+id: 5438113c-cdd9-11eb-93b8-acde48001122
+version: 1
+date: '2021-06-15'
+author: Teoderick Contreras, Splunk
+type: streaming
+datamodel:
+- Endpoint
+description: The wevtutil.exe application is the windows event log utility. This searches
+  for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, 
+  or system event logs.
+search: '| from read_ssa_enriched_events() 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") 
+  AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true 
+  OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true 
+  OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  |into write_ssa_detected_events();'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: The wevtutil.exe application is a legitimate Windows event
+  log utility. Administrators may use it to manage Windows event logs.
+references:
+- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+  - Clop Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1070.001
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
new file mode 100644
index 0000000000..5e67e1b099
--- /dev/null
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -0,0 +1,47 @@
+name: Wevtutil Usage To Disable Logs
+id: a4bdc944-cdd9-11eb-ac97-acde48001122
+version: 1
+date: '2021-06-15'
+author: Teoderick Contreras, Splunk
+type: streaming
+datamodel:
+- Endpoint
+description: This search is to detect execution of wevtutil.exe to disable logs. This
+  technique was seen in several ransomware to disable the event logs to evade alerts
+  and detections in compromised host.
+search: '| from read_ssa_enriched_events() 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  |into write_ssa_detected_events();'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: network operator may disable audit event logs for debugging purposes.
+references:
+- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1070.001
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
new file mode 100644
index 0000000000..3d028e17a9
--- /dev/null
+++ b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
@@ -0,0 +1,14 @@
+name: WevtUtil Usage To Clear Logs Unit Test
+tests:
+  - name: WevtUtil Usage To Clear Logs
+    file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for wevtutil clear logs command
+    attack_data:
+      - file_name: clear_evt.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
+        source: WinEventLog:Security
+
+
+
+
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
new file mode 100644
index 0000000000..d417fd8647
--- /dev/null
+++ b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
@@ -0,0 +1,10 @@
+name: Wevtutil Usage To Disable Logs Unit Test
+tests:
+  - name: Wevtutil Usage To Disable Logs
+    file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for wevtutil disable logs command
+    attack_data:
+      - file_name: disable_evt.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+        source: WinEventLog:Security
\ No newline at end of file

From fb1ce4133b54ac932e33fff24a01be0c3f1ff192 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 16 Jun 2021 17:01:00 +0200
Subject: [PATCH 2/8] ssa2

---
 ...___deny_permission_using_cacls_utility.yml | 47 ++++++++++++++++++
 ...__grant_permission_using_cacls_utility.yml | 46 ++++++++++++++++++
 ...fy_acls_permission_of_files_or_folders.yml | 48 +++++++++++++++++++
 ...ny_permission_using_cacls_utility.test.yml | 13 +++++
 ...nt_permission_using_cacls_utility.test.yml | 10 ++++
 ...ls_permission_of_files_or_folders.test.yml | 10 ++++
 6 files changed, 174 insertions(+)
 create mode 100644 detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
 create mode 100644 detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
 create mode 100644 detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
 create mode 100644 tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml
 create mode 100644 tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml
 create mode 100644 tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml

diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
new file mode 100644
index 0000000000..59435772f3
--- /dev/null
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -0,0 +1,47 @@
+name: Deny Permission using Cacls Utility
+id: b76eae28-cd25-11eb-9c92-acde48001122
+version: 1
+date: '2021-06-14'
+author: Teoderick Contreras, Splunk
+type: streaming
+datamodel:
+- Endpoint
+description: This analytic identifies a potential adversary that changes the security
+  permission of a specific file or directory. This technique is commonly seen in APT
+  tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent
+  access to their component files.
+search: '| from read_ssa_enriched_events() 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
+  | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true 
+  AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+known_false_positives: network administrator may use this windows utility but this is not a common practice.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
new file mode 100644
index 0000000000..5872b6e1f4
--- /dev/null
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -0,0 +1,46 @@
+name: Grant Permission Using Cacls Utility
+id: c6da561a-cd29-11eb-ae65-acde48001122
+version: 1
+date: '2021-06-14'
+author: Teoderick Contreras, Splunk
+type: streaming
+datamodel:
+- Endpoint
+description: This analytic identifies potential adversaries that modify the security
+  permission of a specific file or directory. This technique is commonly seen in APT
+  tradecraft and coinminer scripts to evade detections and restrict access to their
+  component files.
+search: '| from read_ssa_enriched_events() 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
+  | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true 
+  AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+known_false_positives: network administrator may use this windows utility but this is not a common practice.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
new file mode 100644
index 0000000000..715a702aff
--- /dev/null
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -0,0 +1,48 @@
+name: Modify ACLs Permission Of Files Or Folders
+id: 9ae9a48a-cdbe-11eb-875a-acde48001122
+version: 1
+date: '2021-06-15'
+author: Teoderick Contreras, Splunk
+type: streaming
+datamodel:
+- Endpoint
+description: This analytic identifies suspicious modification of ACL permission to
+  a files or folder to make it available to everyone. This technique may be used by
+  the adversary to evade ACLs or protected files access. This changes is commonly
+  configured by the file or directory owner with appropriate permission. This behavior
+  is a good indicator if this command seen on a machine utilized by an account with
+  no permission to do so.
+search: '| from read_ssa_enriched_events() 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) 
+  AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+known_false_positives: network administrator may use this windows utility. filter is needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml b/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml
new file mode 100644
index 0000000000..75a5876c7d
--- /dev/null
+++ b/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml
@@ -0,0 +1,13 @@
+name: Deny Permission using Cacls Utility Unit Test
+tests:
+  - name: Deny Permission using Cacls Utility
+    file: endpoint/ssa___deny_permission_using_cacls_utility.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for cacls deny permission to a file(s) or folder(s)
+    attack_data:
+      - file_name: all_icalc.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+        source: WinEventLog:Security
+
+
+    
\ No newline at end of file
diff --git a/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml b/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml
new file mode 100644
index 0000000000..934a25d779
--- /dev/null
+++ b/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml
@@ -0,0 +1,10 @@
+name: Grant Permission Using Cacls Utility Unit Test
+tests:
+  - name: Grant Permission Using Cacls Utility
+    file: endpoint/ssa___grant_permission_using_cacls_utility.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for cacls grant permission to a file(s) or folder(s)
+    attack_data:
+      - file_name: all_icalc.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+        source: WinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml b/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml
new file mode 100644
index 0000000000..0e673d9bd8
--- /dev/null
+++ b/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml
@@ -0,0 +1,10 @@
+name: Modify ACLs Permission Of Files Or Folders Unit Test
+tests:
+  - name: Modify ACLs Permission Of Files Or Folders
+    file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for modifying permission of a file(s) or folder(s)
+    attack_data:
+      - file_name: all_icalc.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+        source: WinEventLog:Security
\ No newline at end of file

From b6ab35397af35a5aa55d803eed3087504f2c59b5 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 16 Jun 2021 17:11:08 +0200
Subject: [PATCH 3/8] ssa2

---
 .../endpoint/ssa___deny_permission_using_cacls_utility.yml      | 2 +-
 .../endpoint/ssa___grant_permission_using_cacls_utility.yml     | 2 +-
 .../ssa___modify_acls_permission_of_files_or_folders.yml        | 2 +-
 .../endpoint/ssa___deny_permission_using_cacls_utility.test.yml | 2 +-
 .../ssa___grant_permission_using_cacls_utility.test.yml         | 2 +-
 .../ssa___modify_acls_permission_of_files_or_folders.test.yml   | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 59435772f3..74a24ea8c8 100644
--- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: This analytic identifies a potential adversary that changes the security
   permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent
+  tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent
   access to their component files.
 search: '| from read_ssa_enriched_events() 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index 5872b6e1f4..efb04fcbb7 100644
--- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: This analytic identifies potential adversaries that modify the security
   permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft and coinminer scripts to evade detections and restrict access to their
+  tradecraft, ransomware and coinminer scripts to evade detections and restrict access to their
   component files.
 search: '| from read_ssa_enriched_events() 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 715a702aff..15285b3727 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -7,7 +7,7 @@ type: streaming
 datamodel:
 - Endpoint
 description: This analytic identifies suspicious modification of ACL permission to
-  a files or folder to make it available to everyone. This technique may be used by
+  a files or folder to make it available to everyone or to a specific user. This technique may be used by
   the adversary to evade ACLs or protected files access. This changes is commonly
   configured by the file or directory owner with appropriate permission. This behavior
   is a good indicator if this command seen on a machine utilized by an account with
diff --git a/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml b/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml
index 75a5876c7d..fec66fbbe8 100644
--- a/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml
+++ b/tests/endpoint/ssa___deny_permission_using_cacls_utility.test.yml
@@ -3,7 +3,7 @@ tests:
   - name: Deny Permission using Cacls Utility
     file: endpoint/ssa___deny_permission_using_cacls_utility.yml
     pass_condition: '@count_gt(0)'
-    description: Test for cacls deny permission to a file(s) or folder(s)
+    description: Test for usage of cacls deny permission to a file(s) or folder(s)
     attack_data:
       - file_name: all_icalc.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
diff --git a/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml b/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml
index 934a25d779..12bb3db7cf 100644
--- a/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml
+++ b/tests/endpoint/ssa___grant_permission_using_cacls_utility.test.yml
@@ -3,7 +3,7 @@ tests:
   - name: Grant Permission Using Cacls Utility
     file: endpoint/ssa___grant_permission_using_cacls_utility.yml
     pass_condition: '@count_gt(0)'
-    description: Test for cacls grant permission to a file(s) or folder(s)
+    description: Test for usage of cacls grant permission to a file(s) or folder(s)
     attack_data:
       - file_name: all_icalc.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
diff --git a/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml b/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml
index 0e673d9bd8..01d315285a 100644
--- a/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml
+++ b/tests/endpoint/ssa___modify_acls_permission_of_files_or_folders.test.yml
@@ -3,7 +3,7 @@ tests:
   - name: Modify ACLs Permission Of Files Or Folders
     file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
     pass_condition: '@count_gt(0)'
-    description: Test for modifying permission of a file(s) or folder(s)
+    description: Test for modifying permission of a file(s) or folder(s) using cacls utility.
     attack_data:
       - file_name: all_icalc.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log

From 1199c7f4231688366fa3e9c0cf49eaaf245dee14 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 17 Jun 2021 14:17:36 +0200
Subject: [PATCH 4/8] ssa3

---
 .../endpoint/ssa___deny_permission_using_cacls_utility.yml      | 2 ++
 .../endpoint/ssa___grant_permission_using_cacls_utility.yml     | 2 ++
 .../ssa___modify_acls_permission_of_files_or_folders.yml        | 2 ++
 detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml      | 2 ++
 detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml    | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 74a24ea8c8..12b89f8652 100644
--- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -32,6 +32,8 @@ tags:
   - XMRig
   kill_chain_phases:
   - Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
   mitre_attack_id:
   - T1222
   product:
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index efb04fcbb7..d600f8b4fa 100644
--- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -31,6 +31,8 @@ tags:
   - XMRig
   kill_chain_phases:
   - Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
   mitre_attack_id:
   - T1222
   product:
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 15285b3727..488ae953ff 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -33,6 +33,8 @@ tags:
   - XMRig
   kill_chain_phases:
   - Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
   mitre_attack_id:
   - T1222
   product:
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index 5431ba232a..50f1893b76 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -37,6 +37,8 @@ tags:
   - Clop Ransomware
   kill_chain_phases:
   - Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
   mitre_attack_id:
   - T1070.001
   product:
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index 5e67e1b099..49d5b7121f 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -32,6 +32,8 @@ tags:
   - Ransomware
   kill_chain_phases:
   - Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
   mitre_attack_id:
   - T1070.001
   product:

From 2492795204692edd69559c238316e90479251fbd Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 18 Jun 2021 13:04:26 +0200
Subject: [PATCH 5/8] ssa3

---
 detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml   | 4 ++++
 detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 4 ++++
 tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml   | 5 +++++
 tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml | 5 +++++
 4 files changed, 18 insertions(+)

diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index 50f1893b76..bd077c7539 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -38,7 +38,11 @@ tags:
   kill_chain_phases:
   - Exploitation
   dataset:
+<<<<<<< Updated upstream
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
+=======
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+>>>>>>> Stashed changes
   mitre_attack_id:
   - T1070.001
   product:
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index 49d5b7121f..7cee83cd8a 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -33,7 +33,11 @@ tags:
   kill_chain_phases:
   - Exploitation
   dataset:
+<<<<<<< Updated upstream
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+=======
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+>>>>>>> Stashed changes
   mitre_attack_id:
   - T1070.001
   product:
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
index 3d028e17a9..ed011d6f22 100644
--- a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
+++ b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
@@ -5,8 +5,13 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test for wevtutil clear logs command
     attack_data:
+<<<<<<< Updated upstream
       - file_name: clear_evt.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
+=======
+      - file_name: windows-security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+>>>>>>> Stashed changes
         source: WinEventLog:Security
 
 
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
index d417fd8647..9c43ae2f07 100644
--- a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
+++ b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
@@ -5,6 +5,11 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test for wevtutil disable logs command
     attack_data:
+<<<<<<< Updated upstream
       - file_name: disable_evt.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+=======
+      - file_name: windows-security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+>>>>>>> Stashed changes
         source: WinEventLog:Security
\ No newline at end of file

From 57a3dbc5a3b8ea57d390dbf6f128f154062a0cfe Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 18 Jun 2021 13:10:16 +0200
Subject: [PATCH 6/8] ssa4

---
 detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml   | 4 ----
 detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 4 ----
 tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml   | 5 -----
 tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml | 5 -----
 4 files changed, 18 deletions(-)

diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index bd077c7539..3be5cbbede 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -38,11 +38,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   dataset:
-<<<<<<< Updated upstream
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
-=======
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
->>>>>>> Stashed changes
   mitre_attack_id:
   - T1070.001
   product:
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index 7cee83cd8a..5f3e71f7a9 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -33,11 +33,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   dataset:
-<<<<<<< Updated upstream
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
-=======
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
->>>>>>> Stashed changes
   mitre_attack_id:
   - T1070.001
   product:
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
index ed011d6f22..bee2ee5ddc 100644
--- a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
+++ b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
@@ -5,13 +5,8 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test for wevtutil clear logs command
     attack_data:
-<<<<<<< Updated upstream
-      - file_name: clear_evt.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
-=======
       - file_name: windows-security.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
->>>>>>> Stashed changes
         source: WinEventLog:Security
 
 
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
index 9c43ae2f07..8e029898ba 100644
--- a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
+++ b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
@@ -5,11 +5,6 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test for wevtutil disable logs command
     attack_data:
-<<<<<<< Updated upstream
-      - file_name: disable_evt.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
-=======
       - file_name: windows-security.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
->>>>>>> Stashed changes
         source: WinEventLog:Security
\ No newline at end of file

From 0106cc56bed8d9046aa1ce680f6b83b51b3513d3 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 18 Jun 2021 13:46:01 +0200
Subject: [PATCH 7/8] ssa5

---
 detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml   | 2 +-
 detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 2 +-
 tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml   | 4 ++--
 tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index 3be5cbbede..50f1893b76 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -38,7 +38,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
   mitre_attack_id:
   - T1070.001
   product:
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index 5f3e71f7a9..49d5b7121f 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -33,7 +33,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
   mitre_attack_id:
   - T1070.001
   product:
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
index bee2ee5ddc..3d028e17a9 100644
--- a/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
+++ b/tests/endpoint/ssa___wevtutil_usage_to_clear_logs.test.yml
@@ -5,8 +5,8 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test for wevtutil clear logs command
     attack_data:
-      - file_name: windows-security.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+      - file_name: clear_evt.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
         source: WinEventLog:Security
 
 
diff --git a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
index 8e029898ba..d417fd8647 100644
--- a/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
+++ b/tests/endpoint/ssa___wevtutil_usage_to_disable_logs.test.yml
@@ -5,6 +5,6 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test for wevtutil disable logs command
     attack_data:
-      - file_name: windows-security.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/windows-security.log
+      - file_name: disable_evt.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
         source: WinEventLog:Security
\ No newline at end of file

From 4f55be64a09a1cadf640ee07e0d54808ab6c511f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 18 Jun 2021 15:28:08 +0200
Subject: [PATCH 8/8] ssa6

---
 .../ssa___wevtutil_usage_to_clear_logs.yml    | 21 ++++++++-----------
 .../ssa___wevtutil_usage_to_disable_logs.yml  | 12 +++++------
 2 files changed, 14 insertions(+), 19 deletions(-)

diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index 50f1893b76..afc6927f78 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -9,18 +9,15 @@ datamodel:
 description: The wevtutil.exe application is the windows event log utility. This searches
   for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, 
   or system event logs.
-search: '| from read_ssa_enriched_events() 
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
-  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
-  | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") 
-  AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true 
-  OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true 
-  OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" 
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), 
-  ucast(map_get(input_event, "dest_device_id"), "string", null)), 
-  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
-  |into write_ssa_detected_events();'
+search: '| from read_ssa_enriched_events()
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), 
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
+  | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR 
+  match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR 
+  match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe" 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index 49d5b7121f..8d8765ed13 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -10,14 +10,12 @@ description: This search is to detect execution of wevtutil.exe to disable logs.
   technique was seen in several ransomware to disable the event logs to evade alerts
   and detections in compromised host.
 search: '| from read_ssa_enriched_events() 
-  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), 
-  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), 
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), 
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) 
   | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" 
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), 
-  ucast(map_get(input_event, "dest_device_id"), "string", null)), 
-  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
-  |into write_ssa_detected_events();'
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.