Hunting

Changed to hunting, added renamed logic to not use the process_macro

Issue #2010

detections/deprecated/suspicious_rundll32_rename.yml

@@ -1,7 +1,7 @@
 name: Suspicious Rundll32 Rename
 id: 7360137f-abad-473e-8189-acbdaa34d114
-version: 4
-date: '2022-02-01'
+version: 5
+date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
@@ -13,7 +13,7 @@ description: The following hunting analytic identifies renamed instances of rund
   name from the PE meta data. Expand the query as needed by looking for specific command
   line arguments outlined in other analytics.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=RUNDLL32.exe AND Processes.process_name!=rundll32.exe by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

detections/endpoint/detect_html_help_renamed.yml

@@ -1,7 +1,7 @@
 name: Detect HTML Help Renamed
 id: 62fed254-513b-460e-953d-79771493a9f3
-version: 3
-date: '2021-09-16'
+version: 4
+date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
@@ -18,7 +18,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
   it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=hh.exe AND Processes.original_file_name=HH.EXE by Processes.dest
   Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'

detections/endpoint/detect_mshta_renamed.yml

@@ -1,7 +1,7 @@
 name: Detect mshta renamed
 id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
+version: 3
+date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
@@ -12,7 +12,7 @@ description: The following analytic identifies renamed instances of mshta.exe ex
   binary. Further analysis should be performed to review the executed content and
   validation it is the real mshta.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_mshta` by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=mshta.exe AND Processes.original_file_name=MSHTA.EXE by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

detections/endpoint/detect_renamed_psexec.yml

@@ -1,7 +1,7 @@
 name: Detect Renamed PSExec
 id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 3
-date: '2021-09-16'
+version: 4
+date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
@@ -12,7 +12,7 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   During triage, validate this is the legitimate version of `PsExec` by reviewing
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_psexec` by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!=psexec.exe OR Processes.process_name!=psexec64.exe) AND Processes.original_file_name=psexec.c by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml

@@ -1,7 +1,7 @@
 name: Suspicious microsoft workflow compiler rename
 id: f0db4464-55d9-11eb-ae93-0242ac130002
-version: 3
-date: '2021-09-20'
+version: 4
+date: '2022-04-07'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
@@ -13,7 +13,7 @@ description: The following analytic identifies a renamed instance of microsoft.w
   In any instance, microsoft.workflow.compiler.exe spawning from an Office product
   or any living off the land binary is highly suspect.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler`
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=microsoft.workflow.compiler.exe AND Processes.original_file_name=Microsoft.Workflow.Compiler.exe
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

detections/endpoint/suspicious_msbuild_rename.yml

@@ -1,9 +1,9 @@
 name: Suspicious MSBuild Rename
 id: 4006adac-5937-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
+version: 3
+date: '2022-04-07'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic identifies renamed instances of msbuild.exe executing.
@@ -11,7 +11,7 @@ description: The following analytic identifies renamed instances of msbuild.exe
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_msbuild` by Processes.dest
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=msbuild.exe AND Processes.original_file_name=MSBuild.exe by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`