Branch was auto-updated.

automated_detection_testing/detection_service.py

@@ -105,13 +105,6 @@ def main(args):
     with open('attack_range/attack_range.conf', 'w') as file:
       file.write(filedata)
 
-    # check if terraform is installed
-    if which('terraform') is None:
-        sys.exit(1)
-    else:
-        # init terraform
-        os.system('cd attack_range/terraform/aws && terraform init && cd ../../..')
-
     module = __import__('attack_range')
     module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security_content/tests/' + test_file_name]
 

automated_detection_testing/requirements.txt

@@ -70,7 +70,7 @@ splunk-sdk==1.6.15
 tabulate==0.8.9
 termcolor==1.1.0
 toml==0.10.2
-urllib3==1.26.4
+urllib3==1.26.5
 virtualenv==20.4.6
 wcwidth==0.2.5
 wget==3.2

bin/appinspect.sh

@@ -40,7 +40,7 @@ APPINSPECT_TOKEN=$(curl -s --location --request GET 'https://api.splunk.com/2.0/
 sleep 1
 # submit a inspection job EXPECTS app on same directory
 #REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'app_package=@"/home/circleci/DA-ESS-ContentUpdate-latest.tar.gz"' | jq -r '.request_id')
-REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'app_package=@'$PACKAGE_PATH | jq -r '.request_id')
+REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'included_tags="cloud"' --form 'app_package=@'$PACKAGE_PATH | jq -r '.request_id')
 echo "app inspect request: $REQUEST_ID"
 sleep 5
 STATUS=$(curl -s --location --request GET https://appinspect.splunk.com/v1/app/validate/status/$REQUEST_ID --header "Authorization: bearer $APPINSPECT_TOKEN" | jq -r '.status')

bin/generate-actors-map.py

@@ -11,7 +11,7 @@ from os import path
 from stix2 import FileSystemSource
 from stix2 import Filter
 
-VERSION = "4.1"
+VERSION = "4.2"
 NAME = "Detection Priority by Threat Actors"
 DESCRIPTION = "security_content detection priorty by common techniques used from threat actors"
 DOMAIN = "mitre-enterprise"
@@ -230,8 +230,9 @@ def load_objects(security_content_path, file_path):
     detection_files = path.join(path.expanduser(security_content_path), file_path)
 
     for file in glob.glob(detection_files):
+        file_name  =  file.replace('./detections/', '')
         files.append({
-            "filename": os.path.basename(file),
+            "filename": file_name,
             "object": load_file(file)
         })
 

bin/generate-coverage-map.py

@@ -11,7 +11,7 @@ from os import path
 from stix2 import FileSystemSource
 from stix2 import Filter
 
-VERSION = "4.1"
+VERSION = "4.2"
 NAME = "Detection Coverage"
 DESCRIPTION = "security_content detection coverage"
 DOMAIN = "mitre-enterprise"
@@ -177,7 +177,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
 
 def generate_csv_file(matched_techniques, output):
 
-    security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'
+    security_content_url = 'https://github.com/splunk/security_content/blob/develop/'
 
     with open(output + '/coverage.csv', 'w') as f:
         writer = csv.writer(f)
@@ -199,8 +199,9 @@ def load_objects(security_content_path, file_path):
     detection_files = path.join(path.expanduser(security_content_path), file_path)
 
     for file in glob.glob(detection_files):
+        file_name  =  file.replace('./detections/', '')
         files.append({
-            "filename": os.path.basename(file),
+            "filename": file_name,
             "object": load_file(file)
         })
 

bin/jinja2_templates/savedsearches.j2

@@ -88,6 +88,7 @@ disabled = false
 disabled = true
 {% endif %}
 enableSched = 1
+allow_skew = 100%
 counttype = number of events
 relation = greater than
 quantity = 0

bin/ssa-end-to-end-testing/requirements.txt

@@ -20,4 +20,4 @@ six==1.15.0
 smmap==3.0.5
 toml==0.10.2
 u-msgpack-python==2.7.1
-urllib3==1.26.4
+urllib3==1.26.5

bin/validate.py

@@ -45,6 +45,7 @@ def validate_schema(REPO_PATH, type, objects, verbose):
             except yaml.YAMLError as exc:
                 print(exc)
                 print("Error reading {0}".format(manifest_file))
+                errors.append("ERROR: Error reading {0}".format(manifest_file))
                 error = True
                 continue
 
@@ -258,7 +259,7 @@ def validate_tests(REPO_PATH, object):
                 errors.append('ERROR: orphaned test: {0}, detection file: {1} no longer exists or incorrect detection path under `file`'.format(object['name'], detection_file_path))
         else:
             errors.append('ERROR: test: {0} does not have a detection `file` associated with detection: {1}'.format(object['name'], test['name']))
-        test['file']
+        #test['file']
     return errors
 
 def main(REPO_PATH, verbose):

detections/cloud/aws_iam_accessdenied_discovery_events.yml

@@ -44,4 +44,7 @@ tags:
   - userAgent
   - errorCode
   - userIdentity.type
+  risk_object: src_ip
+  risk_object_type: system
+  risk_score: 20
   security_domain: access

detections/cloud/aws_iam_assume_role_policy_brute_force.yml

@@ -49,4 +49,7 @@ tags:
   - userAgent
   - errorCode
   - requestParameters.policyName
+  risk_object: src
+  risk_object_type: system
+  risk_score: 20
   security_domain: access

detections/cloud/aws_iam_delete_policy.yml

@@ -46,4 +46,7 @@ tags:
   - userAgent
   - errorCode
   - requestParameters.policyArn
+  risk_object: src
+  risk_object_type: system
+  risk_score: 20
   security_domain: access

detections/cloud/aws_iam_failure_group_deletion.yml

@@ -46,4 +46,7 @@ tags:
   - userAgent
   - errorCode
   - requestParameters.groupName
+  risk_object: src
+  risk_object_type: system
+  risk_score: 20
   security_domain: identity

detections/cloud/aws_iam_successful_group_deletion.yml

@@ -45,4 +45,7 @@ tags:
   - userAgent
   - errorCode
   - requestParameters.groupName
+  risk_object: src
+  risk_object_type: system
+  risk_score: 20
   security_domain: identity

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -0,0 +1,49 @@
+name: Allow Inbound Traffic By Firewall Rule Registry
+id: 0a46537c-be02-11eb-92ca-acde48001122
+version: 1
+date: '2021-05-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic detects a potential suspicious modification of firewall
+  rule registry allowing inbound traffic in specific port with public profile. This
+  technique was seen in some attacker want to have a remote access to a machine by
+  allowing the traffic in firewall rule.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
+  Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name =
+  "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name
+  = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: network admin may add/remove/modify public inbound firewall
+  rule that may cause this rule to be triggered.
+references:
+- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
+tags:
+  analytic_story:
+  - Prohibited Traffic Allowed or Protocol Mismatch
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1021.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.dest
+  - Registry.user
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -0,0 +1,44 @@
+name: Allow Inbound Traffic In Firewall Rule
+id: a5d85486-b89c-11eb-8267-acde48001122
+version: 1
+date: '2021-05-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect suspicious powershell command to allow inbound
+  traffic in specific local port with public profile. This technique was seen in some
+  attacker want to have a remote access to a machine by allowing the traffic in firewall
+  rule.
+search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message
+  = "*Inbound*" Message = "*Allow*"  Message = "*-LocalPort*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: administrator may allow inbound traffic in certain network
+  or machine.
+references:
+- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
+tags:
+  analytic_story:
+  - Prohibited Traffic Allowed or Protocol Mismatch
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1021.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log

detections/endpoint/deleting_of_net_users.yml

@@ -0,0 +1,52 @@
+name: Deleting Of Net Users
+id: 1c8c6f66-acce-11eb-aafb-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic will detect a suspicious net.exe/net1.exe command-line
+  to delete a user on a system. This technique may be use by an administrator for
+  legitimate purposes, however this behavior has been used in the wild to impair some
+  user or deleting adversaries tracks created during its lateral movement additional
+  systems. During triage, review parallel processes for additional behavior. Identify
+  any other user accounts created before or after.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.parent_process) as parent_process values(Processes.process_id)
+  as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
+  Processes.process="*user*" AND  Processes.process="*/delete*" by  Processes.process_name
+  Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+known_false_positives: System administrators or scripts may delete user accounts via
+  this technique. Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1531
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_id
+  - Processes.parent_process
+  security_domain: endpoint

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -0,0 +1,50 @@
+name: Disable Windows App Hotkeys
+id: 1490f224-ad8b-11eb-8c4f-acde48001122
+version: 1
+date: '2021-05-05'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic detects a suspicious registry modification to disable Windows
+  hotkey (shortcut keys) for native Windows applications. This technique is commonly
+  used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.
+  This technique is used to impair the analyst in analyzing and removing the attacker
+  implant in compromised systems.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
+  NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name
+  = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest
+  Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  security_domain: endpoint

detections/endpoint/disabling_net_user_account.yml

@@ -0,0 +1,50 @@
+name: Disabling Net User Account
+id: c0325326-acd6-11eb-98c2-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic will identify a suspicious command-line that disables a
+  user account using the `net.exe` utility native to Windows. This technique may used
+  by the adversaries to interrupt availability of such users to do their malicious
+  act.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.parent_process) as parent_process values(Processes.process_id)
+  as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
+  Processes.process="*user*" AND Processes.process="*/active:no*" by  Processes.process_name
+  Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
+  used.
+known_false_positives: unknown
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1531
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_id
+  - Processes.parent_process
+  security_domain: endpoint

detections/endpoint/download_files_using_telegram.yml

@@ -0,0 +1,49 @@
+name: Download Files Using Telegram
+id: 58194e28-ae5e-11eb-8912-acde48001122
+version: 1
+date: '2021-05-06'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic will identify a suspicious download by the Telegram
+  application on a Windows system. This behavior was identified on a honeypot where
+  the adversary gained access, installed Telegram and followed through with downloading
+  different network scanners (port, bruteforcer, masscan) to the system and later
+  used to mapped the whole network and further move laterally.
+search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
+  |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode
+  Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `download_files_using_telegram_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and TargetFilename from your endpoints or Events that
+  monitor filestream events which is happened when process download something. (EventCode
+  15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon
+  TA.
+known_false_positives: normal download of file in telegram app. (if it was a common
+  app in network)
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1105
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - EventCode
+  - Image
+  - process_id
+  - TargetFilename
+  - Hash
+  security_domain: endpoint

detections/endpoint/enable_rdp_in_other_port_number.yml

@@ -0,0 +1,46 @@
+name: Enable RDP In Other Port Number
+id: 99495452-b899-11eb-96dc-acde48001122
+version: 1
+date: '2021-05-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a modification to registry to enable rdp to
+  a machine with different port number. This technique was seen in some atttacker
+  tries to do lateral movement and remote access to a compromised machine to gain
+  control of it.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
+  Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest
+  Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/
+tags:
+  analytic_story:
+  - Prohibited Traffic Allowed or Protocol Mismatch
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1021
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log

detections/endpoint/enumerate_users_local_group_using_telegram.yml

@@ -0,0 +1,49 @@
+name: Enumerate Users Local Group Using Telegram
+id: fcd74532-ae54-11eb-a5ab-acde48001122
+version: 1
+date: '2021-05-06'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic will detect a suspicious Telegram process enumerating all
+  network users in a local group. This technique was seen in a Monero infected honeypot
+  to mapped all the users on the compromised system. EventCode 4798 is generated when
+  a process enumerates a user's security-enabled local groups on a computer or device.
+search: '`wineventlog_security` EventCode=4798  Process_Name = "*\\telegram.exe" |
+  stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode
+  Process_Name  Process_ID Account_Name Account_Domain Logon_ID Security_ID Message
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and
+  filter known instances of process like logonUI used in your environment.
+known_false_positives: unknown
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1087
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ComputerName
+  - EventCode
+  - Process_Name
+  - Process_ID
+  - Account_Name
+  - Account_Domain
+  - Logon_ID
+  - Security_ID
+  - Message
+  security_domain: endpoint

detections/endpoint/excessive_attempt_to_disable_services.yml

@@ -0,0 +1,49 @@
+name: Excessive Attempt To Disable Services
+id: 8fa2a0f0-acd9-11eb-8994-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious series of command-line to disable
+  several services. This technique is seen where the adversary attempts to disable
+  security app services or other malware services to complete the objective on the
+  compromised system.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name =
+  "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name
+  Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
+  count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+known_false_positives: unknown
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1489
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint

detections/endpoint/excessive_service_stop_attempt.yml

@@ -0,0 +1,50 @@
+name: Excessive Service Stop Attempt
+id: ae8d3f4a-acd7-11eb-8846-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies suspicious series of attempt to kill multiple
+  services on a system using either `net.exe` or `sc.exe`. This technique is use by
+  adversaries to terminate security services or other related services to continue
+  there objective and evade detections.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "net.exe"
+  OR  Processes.process_name = "sc.exe" OR  Processes.process_name = "net1.exe" AND
+  Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name
+  Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
+  count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+known_false_positives: unknown
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1489
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint

detections/endpoint/excessive_usage_of_cacls_app.yml

@@ -0,0 +1,49 @@
+name: Excessive Usage Of Cacls App
+id: 0bdf6092-af17-11eb-939a-acde48001122
+version: 1
+date: '2021-05-07'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`
+  or `icacls.exe` application to change file or folder permission. This behavior is
+  commonly seen where the adversary attempts to impair some users from deleting or
+  accessing its malware components or artifact from the compromised system.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id  values(Processes.process_name) as process_name
+  count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes
+  where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe"
+  OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process
+  Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or administrative scripts may use this application.
+  Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint

detections/endpoint/excessive_usage_of_net_app.yml

@@ -0,0 +1,48 @@
+name: Excessive Usage Of Net App
+id: 45e52536-ae42-11eb-b5c6-acde48001122
+version: 1
+date: '2021-05-06'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies excessive usage of `net.exe` or `net1.exe` within
+  a bucket of time (1 minute). This behavior was seen in a Monero incident where the
+  adversary attempts to create many users, delete and disable users as part of its
+  malicious behavior.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "net.exe"
+  OR Processes.process_name = "net1.exe" by Processes.process_name Processes.parent_process_name
+  Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+known_false_positives: unknown. Filter as needed. Modify the time span as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1531
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint

detections/endpoint/excessive_usage_of_nslookup_app.yml

@@ -2,7 +2,7 @@ name: Excessive Usage of NSLOOKUP App
 id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
 version: 1
 date: '2021-04-21'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Stanislav Miskovic, Splunk
 type: batch
 datamodel:
 - Endpoint
@@ -12,12 +12,12 @@ description: this search is to detect potential DNS exfiltration using nslookup
   use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are
   commonly used by attacker and also the retry parameter which is designed to query
   C2 DNS multiple tries.
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process
-  values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process
-  count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name
-  | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`'
+search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" |  bucket _time span=15m
+  | stats count as numNsLookup by Computer, _time |  eventstats avg(numNsLookup) as
+  avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer |  eval
+  upperThreshold=(avgNsLookup + stdNsLookup *3) |  eval isOutlier=if(avgNsLookup >
+  20 and avgNsLookup >= upperThreshold, 1, 0) |  search isOutlier=1 | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/excessive_usage_of_taskkill.yml

@@ -0,0 +1,47 @@
+name: Excessive Usage Of Taskkill
+id: fe5bca48-accb-11eb-a67c-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies excessive usage of `taskkill.exe` application.
+  This application is commonly used by adversaries to evade detections by killing
+  security product processes or even other processes to evade detection.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe"  by
+  Processes.parent_process_name Processes.process_name Processes.dest Processes.user
+  _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
+known_false_positives: Unknown. Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process
+  - Processes.process_id
+  security_domain: endpoint

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -0,0 +1,55 @@
+name: Executables Or Script Creation In Suspicious Path
+id: a7e3f0f0-ae42-11eb-b245-acde48001122
+version: 1
+date: '2021-05-06'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious executable or scripts (known file
+  extensions) in list of suspicious file path in Windows. This technique is used by
+  adversaries to evade detection. The suspicious file path are known paths used in
+  the wild and are not common to have executable or scripts.
+search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
+  file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
+  where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name
+  = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name
+  = *.vbe OR Filesystem.file_name = *.js OR Filesystem.file_name = *.ps1 OR Filesystem.file_name
+  = *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) AND ( Filesystem.file_path
+  = *\\windows\\fonts\\* OR Filesystem.file_path = *\\windows\\temp\\* OR Filesystem.file_path
+  = *\\users\\public\\* OR Filesystem.file_path = *\\windows\\debug\\* OR Filesystem.file_path
+  = *\\Users\\Administrator\\Music\\* OR Filesystem.file_path = *\\Windows\\servicing\\*
+  OR Filesystem.file_path = *\\Users\\Default\\* OR Filesystem.file_path = *Recycle.bin*
+  OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\*
+  OR Filesystem.file_path = *\\AppData\\Local\\Temp*) by Filesystem.file_create_time
+  Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: Administrators may allow creation of script or exe in the paths
+  specified. Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1036
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  security_domain: endpoint

detections/endpoint/hide_user_account_from_sign_in_screen.yml

@@ -0,0 +1,50 @@
+name: Hide User Account From Sign-In Screen
+id: 834ba832-ad89-11eb-937d-acde48001122
+version: 1
+date: '2021-05-05'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies a suspicious registry modification to hide a
+  user account on the Windows Login screen. This technique was seen in some tradecraft
+  where the adversary will create a hidden user account with Admin privileges in login
+  screen to avoid noticing by the user that they already compromise and to persist
+  on that said machine.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
+  NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_name
+  = "DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_value_name
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  | `hide_user_account_from_sign_in_screen_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: Unknown. Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  security_domain: endpoint

detections/endpoint/icacls_deny_command.yml

@@ -0,0 +1,50 @@
+name: Icacls Deny Command
+id: cf8d753e-a8fe-11eb-8f58-acde48001122
+version: 1
+date: '2021-04-29'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies a potential adversary that changes the security
+  permission of a specific file or directory. This technique is commonly seen in APT
+  tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent
+  access to their component files.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe"
+  OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe"
+  AND Processes.process = "*/deny*" by Processes.parent_process_name Processes.process_name
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+known_false_positives: Unknown. It is possible some administrative scripts use ICacls.
+  Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process
+  security_domain: endpoint

detections/endpoint/icacls_grant_command.yml

@@ -0,0 +1,49 @@
+name: ICACLS Grant Command
+id: b1b1e316-accc-11eb-a9b4-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies potential adversaries that modify the security
+  permission of a specific file or directory. This technique is commonly seen in APT
+  tradecraft and coinminer scripts to evade detections and restrict access to their
+  component files.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe"
+  OR Processes.process_name = "cacls.exe" OR Processes.process_name = "xcacls.exe"
+  AND Processes.process = "*/grant*" by Processes.parent_process_name Processes.process_name
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+known_false_positives: Unknown. Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process
+  security_domain: endpoint

detections/endpoint/mailsniper_invoke_functions.yml

@@ -0,0 +1,45 @@
+name: Mailsniper Invoke functions
+id: a36972c8-b894-11eb-9f78-acde48001122
+version: 1
+date: '2021-05-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect known mailsniper.ps1 functions executed in a
+  machine. This technique was seen in some attacker to harvest some sensitive e-mail
+  in a compromised exchange server.
+search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*",
+  "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*",
+  "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*",
+  "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `mailsniper_invoke_functions_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: unknown
+references:
+- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/
+tags:
+  analytic_story:
+  - Data Exfiltration
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1114.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log

detections/endpoint/modify_acl_permission_to_files_or_folder.yml

@@ -0,0 +1,52 @@
+name: Modify ACL permission To Files Or Folder
+id: 7e8458cc-acca-11eb-9e3f-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies suspicious modification of ACL permission to
+  a files or folder to make it available to everyone. This technique may be used by
+  the adversary to evade ACLs or protected files access. This changes is commonly
+  configured by the file or directory owner with appropriate permission. This behavior
+  is a good indicator if this command seen on a machine utilized by an account with
+  no permission to do so.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe"
+  OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe"
+  AND (Processes.process = "*/G everyone:*"  OR Processes.process = "*/G SYSTEM:*")
+  by Processes.parent_process_name Processes.process_name Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `modify_acl_permission_to_files_or_folder_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+known_false_positives: administrators may use this command. Filter as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1222
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process
+  - Processes.process_id
+  security_domain: endpoint

detections/endpoint/process_kill_base_on_file_path.yml

@@ -0,0 +1,48 @@
+name: Process Kill Base On File Path
+id: 5ffaa42c-acdb-11eb-9ad3-acde48001122
+version: 1
+date: '2021-05-04'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of `wmic.exe` using `delete`
+  to remove a executable path. This is typically ran via a batch file during beginning
+  stages of an adversary setting up for mining on an endpoint.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name =
+  "wmic.exe" AND Processes.process="*process*" AND Processes.process="*executablepath*"
+  AND Processes.process="*delete*" by  Processes.parent_process_name Processes.process_name
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed wmic.exe may be used.
+known_false_positives: Unknown.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process
+  - Processes.process_id
+  security_domain: endpoint

detections/endpoint/ransomware_notes_bulk_creation.yml

@@ -9,7 +9,7 @@ datamodel:
 description: The following analytics identifies a big number of instance of ransomware
   notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This
   behavior is a good sensor if the ransomware note filename is quite new for security
-  industry or the ransomware note filename is not in your lookup table list for monitoring.
+  industry or the ransomware note filename is not in your ransomware lookup table list for monitoring.
 search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time
   span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename)
   as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer

detections/endpoint/schedule_task_with_rundll32_command_trigger.yml

@@ -12,14 +12,14 @@ description: The following query utilizes Windows Security EventCode 4698, `A sc
   technique is common in new trickbot that uses rundll32 to load is trickbot downloader.
   The search will return the first time and last time the task was registered, as
   well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
-  it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32`
-  and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or
-  TaskService is launched -`taskschd.dll`. If found loaded by another process, it
-  is possible a scheduled task is being registered within that process context in
-  memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or
-  via TaskService? Review the job created and the Command to be executed. Capture
-  any artifacts on disk and review. Identify any parallel processes within the same
-  timeframe to identify source.'
+  it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and
+  `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService
+  is launched -`taskschd.dll`. If found loaded by another process, it is possible
+  a scheduled task is being registered within that process context in memory. Upon
+  triage, identify the task scheduled source. Was it schtasks.exe or via TaskService?
+  Review the job created and the Command to be executed. Capture any artifacts on
+  disk and review. Identify any parallel processes within the same timeframe to identify
+  source.'
 search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
   ("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
   Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -0,0 +1,49 @@
+name: Schtasks Run Task On Demand
+id: bb37061e-af1f-11eb-a159-acde48001122
+version: 1
+date: '2021-05-07'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies an on demand run of a Windows Schedule Task
+  through shell or command-line. This technique has been used by adversaries that
+  force to run their created Schedule Task as their persistence mechanism or for lateral
+  movement as part of their malicious attack to the compromised machine.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
+  as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "schtasks.exe"
+  Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used.
+known_false_positives: Administrators may use to debug Schedule Task entries. Filter
+  as needed.
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1053
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint

detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml

@@ -0,0 +1,51 @@
+name: SecretDumps Offline NTDS Dumping Tool
+id: 5672819c-be09-11eb-bbfb-acde48001122
+version: 1
+date: '2021-05-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic detects a potential usage of secretsdump.py tool for dumping
+  credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry
+  hive. This technique was seen in some attacker that dump ntlm hashes offline after
+  having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe"
+  Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*"
+  OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process
+  = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `secretdumps_offline_ntds_dumping_tool_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py
+tags:
+  analytic_story:
+  - Credential Dumping
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest Processes.user
+  - Processes.process_id
+  - Processes.process_guid
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log

detections/endpoint/services_escalate_exe.yml

@@ -0,0 +1,59 @@
+name: Services Escalate Exe
+id: c448488c-b7ec-11eb-8253-acde48001122
+version: 1
+date: '2021-05-18'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of `svc-exe` with Cobalt Strike.
+  The behavior typically follows after an adversary has already gained initial access
+  and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded
+  from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following,
+  the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\`
+  with multiple keys and values added to look like a legitimate service. Upon loading,
+  `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`.
+  The process lineage is completed with `400619a.exe` spawning rundll32.exe, which
+  is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary
+  and may be any process on disk (typically system32/syswow64 binary). The `spawnto_`
+  process will also contain a network connection. During triage, review parallel procesess
+  and identify any additional file modifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe
+  Processes.process_path=*admin$* by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `services_escalate_exe_filter`'
+how_to_implement: To successfully implement this search, you will need to ensure that
+  DNS data is populating the Network_Resolution data model.
+known_false_positives: False positives should be limited as `services.exe` should
+  never spawn a process from `ADMIN$`. Filter as needed.
+references:
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+- https://attack.mitre.org/techniques/T1548/
+- https://www.cobaltstrike.com/help-beacon
+tags:
+  analytic_story:
+  - Cobalt Strike
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint

detections/endpoint/ssa___system_process_running_unexpected_location.yml

@@ -1,6 +1,6 @@
 name: System Process Running from Unexpected Location
 id: 28179107-099a-464a-94d3-08301e6c055f
-version: 1
+version: 2
 date: '2020-08-25'
 author: Ignacio Bermudez Corrales, Splunk
 type: streaming

detections/endpoint/suspicious_driver_loaded_path.yml

@@ -0,0 +1,52 @@
+name: Suspicious Driver Loaded Path
+id: f880acd4-a8f1-11eb-a53b-acde48001122
+version: 1
+date: '2021-04-29'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic will detect suspicious driver loaded paths. This technique
+  is commonly used by malicious software like coin miners (xmrig) to register its
+  malicious driver from notable directories where executable or drivers do not commonly
+  exist. During triage, validate this driver is for legitimate business use. Review
+  the metadata and certificate information. Unsigned drivers from non-standard paths
+  is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe`
+  for possible other drivers of interest. Long tail analyze drivers by path (outside
+  of default, and in default) for further review.
+search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*",
+  "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) |  stats  min(_time) as
+  firstTime max(_time) as lastTime count by  Computer ImageLoaded Hashes IMPHASH Signature
+  Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_driver_loaded_path_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the driver loaded and Signature from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: Limited false positives will be present. Some applications
+  do load drivers
+references:
+- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
+- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - ImageLoaded
+  - Hashes
+  - IMPHASH
+  - Signature
+  - Signed
+  security_domain: endpoint

detections/endpoint/suspicious_process_file_path.yml

@@ -0,0 +1,55 @@
+name: Suspicious Process File Path
+id: 9be25988-ad82-11eb-a14f-acde48001122
+version: 1
+date: '2021-05-05'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic will detect a suspicious process running in a
+  file path where a process is not commonly seen and is most commonly used by malicious
+  softtware. This behavior has been used by adversaries where they drop and run an
+  exe in a path that is accessible without admin privileges.
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*"
+  OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*"
+  OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path
+  = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*"
+  OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path
+  = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path
+  = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" by Processes.parent_process_name
+  Processes.parent_process Processes.process_path Processes.dest Processes.user |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_process_file_path_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators may allow execution of specific binaries in
+  non-standard paths. Filter as needed.
+references:
+- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1543
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_path
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint

detections/endpoint/xmrig_driver_loaded.yml

@@ -0,0 +1,44 @@
+name: XMRIG Driver Loaded
+id: 90080fa6-a8df-11eb-91e4-acde48001122
+version: 1
+date: '2021-04-29'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies XMRIG coinminer driver installation on the system.
+  The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open
+  source project that is commonly abused by adversaries to infect and mine bitcoin.
+search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys"
+  |  stats  min(_time) as firstTime max(_time) as lastTime count by  Computer ImageLoaded
+  Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `xmrig_driver_loaded_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the driver loaded and Signature from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: False positives should be limited.
+references:
+- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
+tags:
+  analytic_story:
+  - XMRig
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - ImageLoaded
+  - Hashes
+  - IMPHASH
+  - Signature
+  - Signed
+  security_domain: endpoint

detections/experimental/endpoint/winrm_spawning_a_process.yml

@@ -0,0 +1,53 @@
+name: WinRM Spawning a Process
+id: a081836a-ba4d-11eb-8593-acde48001122
+version: 1
+date: '2021-05-21'
+author: Drew Church, Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies suspicious processes spawning from
+  WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166.
+  which is a kernel-mode device driver http.sys vulnerability. Current proof of concept
+  code will blue-screen the operating system. However, http.sys used by many different
+  Windows processes, including WinRM. In this case, identifying suspicious process
+  create (child processes) from `wsmprovhost.exe` is what this analytic is identifying.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wsmprovhost.exe
+  Processes.process_name IN ("cmd.exe","sh.exe","bash.exe","powershell.exe","pwsh.exe","schtasks.exe","certutil.exe","whoami.exe","bitsadmin.exe","scp.exe")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrm_spawning_a_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Unknown. Add new processes or filter as needed. It is possible
+  system management software may spawn processes from `wsmprovhost.exe`.
+references:
+- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml
+- https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys
+- https://github.com/0vercl0k/CVE-2021-31166/blob/main/cve-2021-31166.py
+tags:
+  analytic_story:
+  - Unusual Processes
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  - Denial of Service
+  mitre_attack_id:
+  - T1190
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint

detections/network/plain_http_post_exfiltrated_data.yml

@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-22'
 author: Teoderick Contreras, Splunk
 type: batch
-datamodel: []
+datamodel:
+- Network_Traffic
 description: This search is to detect potential plain HTTP POST method data exfiltration.
   This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary
   where arguments or commands are sent in plain text to the remote C2 server using

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.21.0"
+      "version": "3.22.0"
     }, 
     "author": [
       {

dist/escu/appserver/static/analytic_story_details.css

@@ -1,187 +0,0 @@
-/* .rTable {
-  	display: table;
-  	width: 100%;
-}
-
-.rTableRow {
-  	display: table-row;
-}
-
-.rTableHeading {
-  	display: table-header-group;
-  	background-color: #ddd;
-}
-
-.rTableCell, .rTableHead {
-  	display: table-cell;
-  	padding: 3px 10px;
-  	//border: 1px solid #999999;
-}
-
-.rTableLeftCell {
-  	display: table-cell;
-  	padding: 3px 10px;
-  	//border: 1px solid #999999;
-	width: 200px;
-}
-
-.rTableHeading {
-  	display: table-header-group;
-  	background-color: #ddd;
-  	font-weight: bold;
-}
-
-.rTableFoot {
-  	display: table-footer-group;
-  	font-weight: bold;
-  	background-color: #ddd;
-}
-
-.rTableBody {
-  	display: table-row-group;
-} */
-
-h1 {
-	font-size: 24px;
-    font-weight: 200;
-    margin: 0;
-}
-
-h3 {
-	padding-left: 10px;
-}
-
-.as_title_attr_bar {
-	padding-left: 15%;
-    background-color: #eee;
-    height: 40px;
-	line-height: 40px;
-	margin-bottom: 7px;
-}
-
-.as_title_attr {
-	float: left;
-	margin-right: 5%;
-	padding-right: 20px;
-	font-size: 14px;
-}
-
-.as_search_accordion {
-	width: 100%;
-	margin-top: 10px;
-}
-
-.as_story_details {
-	display: flex;
-	max-height: 500px;
-	clear: both;
-}
-
-.as_story_details_left_col {
-	float: right;
-	width: 34%;
-	display: block;
-	overflow: scroll;
-	padding: 10px;
-	margin: 10px;
-	border: 1px solid #ddd;
-}
-
-.as_story_details_right_col {
-	float: left;
-	width: 60%;
-	overflow: scroll;
-	padding: 10px;
-	margin: 10px;
-	border: 1px solid #ddd;
-}
-
-.as_left_attr{
-	display: inline-block;
-	width: 100%;
-}
-
-.as_story_detail_left_attr_label {
-	float: left;
-	width: 30%;
-	padding-top: 2%;
-}
-
-.as_story_detail_left_attr {
-	margin-top: 5px;
-	float: left;
-	width: 70%;
-}
-
-.value_label {
-	float: left;
-    margin-right: 5px;
-    background-color: #eee;
-    padding: 4px;
-	border-radius: 6px;
-    margin-bottom: 5px;
-}
-
-.as_story_detail_right_attr_label {
-	margin-bottom: 7px;
-}
-
-.search_content {
-	display: flex;
-	clear: both;
-}
-
-.search_left_panel {
-	float: left;
-	width: 70%;
-	margin: 10px;
-	padding: 10px;
-	border: 1px solid #ddd;
-}
-
-.search_right_panel {
-	float: left;
-	width: 25%;
-	margin: 10px;
-	padding: 10px;
-	border: 1px solid #ddd;
-}
-
-.search_left_attr {
-	margin: 10px;
-}
-
-.search_right_attr {
-	margin: 10px;
-	display: table;
-}
-
-.search_string{
-	padding: 10px;
-    background-color: #ddd;
-    border: 1px solid #aaa;
-    border-radius: 2px;
-}
-
-.data_model_tag {
-	background-color: #11a88b;
-}
-
-.kill_chain_tag {
-	background-color: #ed8440;
-	color: #303841;
-}
-
-.attack_tag {
-	background-color: #3863a0;
-	color: #eee;
-}
-
-.heading-story {
-	width: 80%;
-	float: left;
-}
-
-.run_story_btn {
-	float: right;
-}

dist/escu/appserver/static/analytic_story_details.js

@@ -1,575 +0,0 @@
-require([
-    'underscore',
-    'jquery',
-    'splunkjs/mvc',
-    'splunkjs/mvc/searchmanager',
-    'splunkjs/mvc/searchbarview',
-    'splunkjs/mvc/tableview',
-    'splunk.util',
-    '../app/DA-ESS-ContentUpdate/js/lib/showdown.min',
-    '../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui',
-    'css!../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui.css',
-    'css!../app/DA-ESS-ContentUpdate/analytic_story_details.css',
-    'splunkjs/mvc/simplexml/ready!'
-], function(_, $, mvc, SearchManager, SearchBarView, TableView, splunkUtil, showdown) {
-
-    let tokenModel = mvc.Components.get("default");
-    let renderedComponents = [];
-
-    let templ = `
-                 <div class="as_title_attr_bar">
-                    <div class="as_title_attr">
-                        <strong>Category: </strong><span id="as_label_category"></span>
-                    </div>
-                    <div class="as_title_attr">
-                        <strong>Version: </strong><span id="as_label_version"></span>
-                    </div>
-                    <div class="as_title_attr">
-                        <strong>Created: </strong><span id="as_label_created"></span>
-                    </div>
-                    <div class="as_title_attr">
-                        <strong>Modified: </strong><span id="as_label_modified"></span>
-                    </div>
-                </div>
-                <div class="headline_story">
-                    <div class="heading-story">
-                        <h1 id="story_heading"></h1>
-                    </div>
-                    <div class="run_story_btn">
-                        <button class="btn btn-primary run-story">Run Analytics</button>
-                    </div>
-                </div>
-                <div class="as_story_details">
-                    <div class="as_story_details_right_col">
-                        <div class="as_story_detail_right_attr_label">
-                            <strong>Description: </strong>
-                        </div>
-                        <div class="as_story_detail_right_attr_label">
-                            <span id="description"></span>
-                        </div>
-                        <div class="as_story_detail_right_attr_label">
-                            <strong>Narrative: </strong>
-                        </div>
-                        <div class="as_story_detail_right_attr_label narrative_value">
-                            <span id="narrative"></span>
-                        </div>
-                    </div>
-                    <div class="as_story_details_left_col">
-                        <div class="as_left_attr">
-                            <div class="as_story_detail_left_attr_label">
-                                <strong>ATT&CK: </strong>
-                            </div>
-                            <div class="as_story_detail_left_attr" id="mitre_attack">
-                            </div>
-                        </div>
-                        <div class="as_left_attr">
-                            <div class="as_story_detail_left_attr_label">
-                                <strong>Kill Chain Phases: </strong>
-                            </div>
-                            <div class="as_story_detail_left_attr kill_chain_phases" id="kill_chain_phases">
-                            </div>
-                        </div>
-                        <div class="as_left_attr">
-                            <div class="as_story_detail_left_attr_label">
-                                <strong>CIS Controls: </strong>
-                            </div>
-                            <div class="as_story_detail_left_attr" id="cis_20">
-                            </div>
-                        </div>
-                        <div class="as_left_attr">
-                            <div class="as_story_detail_left_attr_label">
-                                <strong>Data Model: </strong>
-                            </div>
-                            <div class="as_story_detail_left_attr" id="data_model">
-                            </div>
-                        </div>
-                        <div class="as_left_attr">
-                            <div class="as_story_detail_left_attr_label">
-                                <strong>References: </strong>
-                            </div>
-                            <div class="as_story_detail_left_attr" id="references">
-                            </div>
-                        </div>
-                    </div>
-                 </div>
-                 <div class="as_search_details">
-                    <h2>
-                        Analytic Story Searches
-                    </h2>
-                    <div id="accordion">
-                        <h3>Detection</h3>
-                        <div>
-                            <div id="search_detection">
-                            </div>
-                        </div>
-                        <h3>Investigative</h3>
-                        <div>
-                            <div id="search_investigative">
-                            </div>
-                        </div>
-                        <h3>Support</h3>
-                        <div>
-                            <div id="search_support">
-                            </div>
-                        </div>
-                    </div>
-                 </div>
-                `;
-
-    $('#analytic_story_details').html(_.template(templ));
-
-    if (tokenModel.get('analytic_story_name')) {
-        fetchAnalyticStoryDetails(tokenModel.get('analytic_story_name'));
-    }
-
-    tokenModel.on("change:analytic_story_name", function(model, value, options) {
-        fetchAnalyticStoryDetails(value);
-    });
-
-    function fetchAnalyticStoryDetails(asName) {
-        let epoch = (new Date).getTime();
-        let searchGetAnalyticStoryData = new SearchManager({
-            id: epoch,
-            earliest_time: "-1h@h",
-            latest_time: "now",
-            cache: false,
-            search: "| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | search title=\"" + asName + "\" | spath input=reference path={} output=ref | spath input=data_models path={} output=dm | table title, category, description, version, mappings, creation_date, modification_date, dm, narrative, ref"
-        });
-
-        $('.run-story').unbind('click');
-
-        $('.run-story').on('click', function(evt) {
-        	window.open('/en-US/app/Splunk_ASX/execute?form.mode=now&form.cron=*%2F15%20*%20*%20*%20*&form.earliest_time=-15m&form.latest_time=now&form.time.earliest=-24h%40h&form.time.latest=now&form.story=' + asName);
-        });
-
-        let asSearch = splunkjs.mvc.Components.getInstance(epoch);
-        let asResults = asSearch.data("results", {
-            count: 0
-        });
-        asResults.on("data", function() {
-            let as_attributes = {};
-            let fields = asResults.data().fields;
-            let rows = asResults.data().rows;
-
-            for (let i = 0; i < fields.length; i++) {
-                as_attributes[fields[i]] = rows[0][i];
-            }
-            renderStoryAttributes(as_attributes);
-        });
-
-        var searchGetSearchesData = new SearchManager({
-            id: "s" + epoch,
-            earliest_time: "-1h@h",
-            latest_time: "now",
-            cache: false,
-            search: "| rest /services/saved/searches splunk_server=local count=0 | spath input=action.escu.analytic_story path={} output=uc | search uc = \"" + asName + "\" | spath input=action.escu.data_models path={} output=dm | table action.escu.full_search_name, search, description, action.escu.search_type, action.escu.how_to_implement, action.escu.eli5, action.escu.version, action.escu.mappings, dm, tex, action.escu.asset_at_risk, action.escu.confidence, action.escu.known_false_positives, updated, action.escu.modification_date, action.escu.creation_date "
-
-        });
-        var searchesSearch = splunkjs.mvc.Components.getInstance("s" + epoch);
-        var searchesResults = searchesSearch.data("results", {
-            count: 0
-        });
-
-
-        searchesResults.on("data", function() {
-            let asSearchAttr = [];
-            var fields = searchesResults.data().fields;
-            var rows = searchesResults.data().rows;
-
-            for (let i = 0; i < rows.length; i++) {
-                let searchObj = {};
-                for (let j = 0; j < fields.length; j++) {
-                    searchObj[fields[j]] = rows[i][j];
-                }
-                asSearchAttr.push(searchObj);
-            }
-            renderSearches(asSearchAttr);
-        });
-    }
-
-    function renderStoryAttributes(asAttributes) {
-        let converter = new showdown.Converter();
-        let mappings = JSON.parse(asAttributes.mappings);
-        $('#as_label_category').html(asAttributes.category);
-        $('#as_label_version').html(asAttributes.version);
-        $('#as_label_created').html(asAttributes.creation_date);
-        $('#as_label_modified').html(asAttributes.modification_date);
-        $('#story_heading').html(asAttributes.title);
-        $('#attack').html(mappings.mitre_attack);
-        $('#narrative').html(converter.makeHtml(asAttributes.narrative));
-        $('#description').html(converter.makeHtml(asAttributes.description));
-        $('#mitre_attack').html(getValueLabels(mappings.mitre_attack, 'attack_tag'));
-        $('#data_model').html(getValueLabels(asAttributes.dm, 'data_model_tag'));
-        $('#kill_chain_phases').html(getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag'));
-        $('#cis_20').html(getValueLabels(mappings.cis20));
-        $('#references').html(getReferenceURLS(asAttributes.ref));
-    }
-
-    function getReferenceURLS(refs) {
-        if (refs === null) {
-            return " ";
-        } else {
-            let refsResult = ``;
-            if (Array.isArray(refs)) {
-                refs.map(ref => {
-                    refsResult = refsResult + `<a href="${ ref }">${ ref }</a><br />`;
-                });
-            } else {
-                refsResult = refsResult + `<a href="${ refs }">${ refs }</a><br />`
-            }
-
-            return refsResult;
-        }
-    }
-
-    function renderSearches(asSearches) {
-        clearSearchView();
-        let i = 0;
-        let converter = new showdown.Converter();
-        asSearches.forEach(search => {
-            i++;
-            let epoch = (new Date).getTime();
-            let searchID = `#search${ i }`;
-            let resultID = `#result${ i }`;
-            let searchSelector = `search${ i }`;
-            let controlID = `as_search${ i }`
-            let resultsControlID = `as_results_search${ i }`;
-            let btnID = `btn_es_${i}`;
-
-            let searchPanel = `
-                            <h3>${ search['action.escu.full_search_name'] }</h3>
-                            <div class="search_content" id="${searchSelector}-content">
-                                <div class="search_left_panel">
-                                    <button class="configure_in_es btn btn-primary" id="${ btnID }" data-search-type="${search['action.escu.search_type']}"  data-search-name="${ search['action.escu.full_search_name'] }">Configure</button>
-                                    <div class="search_left_attr">
-                                        <div class="search_left_attr_label">
-                                            <strong>Description</strong>
-                                        </div>
-                                        <div class="search_left_attr_value">
-                                            ${ converter.makeHtml(search['description']) }
-                                        </div>
-                                    </div>
-                                    <div id="${searchSelector}-eli5">
-                                    </div>
-                                    <div class="search_left_attr">
-                                        <div class="search_left_attr_label">
-                                            <strong>Search</strong>
-                                        </div>
-                                        <div class="search_left_attr_value ${ controlID }">
-                                        </div>
-                                        <div class="search_left_attr_value ${ resultsControlID }">
-                                        </div>
-                                    </div>
-                                    <div class="search_left_attr">
-                                        <div class="search_left_attr_label">
-                                            <strong>How to Implement</strong>
-                                        </div>
-                                        <div class="search_left_attr_value">
-                                            ${ converter.makeHtml(search['action.escu.how_to_implement']) }
-                                        </div>
-                                    </div>
-                                    <div class="search_left_attr">
-                                        <div class="search_left_attr_label">
-                                            <strong>Known False Positives</strong>
-                                        </div>
-                                        <div class="search_left_attr_value">
-                                            ${ converter.makeHtml(search['action.escu.known_false_positives']) }
-                                        </div>
-                                    </div>
-                                </div>
-                                <div class="search_right_panel">
-                                    <div class="search_right_attr data_model_srch_attr">
-                                        <div class="search_right_attr_label">
-                                            <strong>Data Models</strong>
-                                        </div>
-                                        <div class="search_right_attr_value">
-                                            ${ getValueLabels(search['dm'], 'data_model_tag') }
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>`;
-
-            if (search['action.escu.search_type'] === "support") {
-                //Process Support Search Accordion
-
-                let mappings = JSON.parse(search['action.escu.mappings']);
-                $('#search_support').append(searchPanel);
-
-                // Adding extra params to support search
-                let supportLeftAttr = `<div class="search_left_attr">
-                    <div class="search_right_attr_label">
-                        <strong>Explain It Like I'm 5</strong>
-                    </div>
-                    <div class="search_left_attr_value">
-                        ${ converter.makeHtml(search['action.escu.eli5']) }
-                    </div>
-                </div>`;
-
-
-                $(`#${searchSelector}-eli5`).append(supportLeftAttr);
-
-            } else if (search['action.escu.search_type'] === "detection") {
-                let mappings = JSON.parse(search['action.escu.mappings']);
-                $('#search_detection').append(searchPanel);
-                // Adding extra params to detection search
-                let detectionAttrTop = `
-                <div class="search_right_attr">
-                    <div class="search_right_attr_label">
-                        <strong>ATT&CK</strong>
-                    </div>
-                    <div class="search_right_attr_value">
-                        ${ getValueLabels(mappings.mitre_attack, 'attack_tag') }
-                    </div>
-                </div>
-                <div class="search_right_attr">
-                    <div class="search_right_attr_label">
-                      <strong>Kill Chain Phases</strong>
-                    </div>
-                    <div class="search_right_attr_value">
-                        ${ getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag') }
-                    </div>
-                </div>
-                <div class="search_right_attr">
-                    <div class="search_right_attr_label">
-                        <strong>CIS Controls</strong>
-                    </div>
-                    <div class="search_right_attr_value">
-                        ${ getValueLabels(mappings.cis20) }
-                    </div>
-                </div>
-                `;
-
-                let detectionAttrBottom = `
-                <div class="search_right_attr">
-                    <div class="search_right_attr_label">
-                        <strong>Asset at Risk</strong>
-                    </div>
-                    <div class="search_right_attr_value">
-                        ${ search['action.escu.asset_at_risk'] }
-                    </div>
-                </div>
-                <div class="search_right_attr">
-                    <div class="search_right_attr_label">
-                        <strong>Confidence</strong>
-                    </div>
-                    <div class="search_right_attr_value">
-                        ${ search['action.escu.confidence'] }
-                    </div>
-                </div>
-                 <div class="search_right_attr">
-                    <div class="search_right_attr_label">
-                        <strong>Creation Date</strong>
-                    </div>
-                    <div class="search_right_attr_value">
-                        ${ search['action.escu.creation_date'] }
-                    </div>
-                </div>
-                 <div class="search_right_attr">
-                    <div class="search_right_attr_label">
-                        <strong>Modification Date</strong>
-                    </div>
-                    <div class="search_right_attr_value">
-                        ${ search['action.escu.modification_date'] }
-                    </div>
-                </div>`;
-
-                let detectionLeftAttr = `<div class="search_left_attr">
-                        <div class="search_right_attr_label">
-                            <strong>Explain It Like I'm 5</strong>
-                        </div>
-                        <div class="search_left_attr_value">
-                            ${ converter.makeHtml(search['action.escu.eli5']) }
-                        </div>
-                    </div>`;
-                $(detectionAttrTop).insertBefore($(`#${searchSelector}-content`).find('.data_model_srch_attr'));
-                $(`#${searchSelector}-content`).find('.search_right_panel').append(detectionAttrBottom);
-                $(`#${searchSelector}-eli5`).append(detectionLeftAttr);
-            } else if (search['action.escu.search_type'] === "contextual") {
-                //Process contextual Search Accordion
-
-                let mappings = JSON.parse(search['action.escu.mappings']);
-                $('#search_contextual').append(searchPanel);
-
-
-                // Adding extra params to contextual search
-                let contextualLeftAttr = `<div class="search_left_attr">
-                    <div class="search_right_attr_label">
-                        <strong>Explain It Like I'm 5</strong>
-                    </div>
-                    <div class="search_left_attr_value">
-                        ${ converter.makeHtml(search['action.escu.eli5']) }
-                    </div>
-                </div>`;
-                $(`#${searchSelector}-eli5`).append(contextualLeftAttr);
-
-            } else if (search['action.escu.search_type'] === "investigative") {
-                //Process Investigative Search Accordion
-                let mappings = JSON.parse(search['action.escu.mappings']);
-                $('#search_investigative').append(searchPanel);
-
-                // Adding extra params to investigative search
-                let investigativeLeftAttr = `<div class="search_left_attr">
-                    <div class="search_right_attr_label">
-                        <strong>Explain It Like I'm 5</strong>
-                    </div>
-                    <div class="search_left_attr_value">
-                        ${ converter.makeHtml(search['action.escu.eli5']) }
-                    </div>
-                </div>`;
-
-
-                $(`#${searchSelector}-eli5`).append(investigativeLeftAttr);
-            }
-
-            /*
-            let updatedAttr = `
-            <div class="search_right_attr">
-                <div class="search_right_attr_label">
-                    <strong>Last Updated</strong>
-                </div>
-                <div class="search_right_attr_value">
-                    ${ search['updated'] }
-                </div>
-            </div>
-            `;
-            $(`#${searchSelector}-content`).find('.search_right_panel').append(updatedAttr);
-            */
-
-            $(`#${ btnID }`).on('click', (evt) => {
-                console.log($(evt.target).data("searchType"));
-                if ($(evt.target).data("searchType") === "detection") {
-                    splunkUtil.redirect_to('app/SplunkEnterpriseSecuritySuite/correlation_search_edit', {
-                        search: `${$(evt.target).data("searchName")}`
-                    }, window.open(), true);
-                } else {
-                    splunkUtil.redirect_to(`manager/DA-ESS-ContentUpdate/saved/searches`, {
-                        search: `${$(evt.target).data("searchName")}`
-                    }, window.open(), true);
-                }
-            })
-
-            let searchManagerID = search['action.escu.full_search_name'].split(' ').join('');
-
-            let searchManager = new SearchManager({
-                id: searchManagerID,
-                earliest_time: "-24h@h",
-                latest_time: "now",
-                status_buckets: 300,
-                required_field_list: "*",
-                preview: true,
-                cache: true,
-                autostart: false, // Prevent the search from running automatically
-                search: search['search'],
-            });
-
-            let searchBar = new SearchBarView({
-                id: searchID,
-                managerId: searchManagerID,
-                timerange: true,
-                el: $('.' + controlID),
-                value: search['search'],
-                timerange_preset: "Last 24 hours"
-            }).render();
-
-            let tableviewer = new TableView({
-                id: resultsControlID,
-                managerid: searchManagerID,
-                pageSize: 5,
-                el: $("." + resultsControlID)
-            }).render();
-
-            searchBar.on("change", function() {
-                searchManager.settings.unset("search");
-
-                // Update the search query
-                searchManager.settings.set("search", searchBar.val());
-
-                // Run the search (because autostart=false)
-                searchManager.startSearch();
-            });
-
-            searchBar.timerange.on("change", function() {
-                // Update the time range of the search
-                searchManager.search.set(searchBar.timerange.val());
-
-                // Run the search (because autostart=false)
-                searchManager.startSearch();
-            })
-
-
-            renderedComponents.push(searchID, searchManagerID, resultsControlID);
-
-        });
-
-        $('#accordion').accordion({
-            heightStyle: "content"
-        });
-        $('#search_support').accordion({
-            heightStyle: "content"
-        });
-        $('#search_detection').accordion({
-            heightStyle: "content"
-        });
-        $('#search_contextual').accordion({
-            heightStyle: "content"
-        });
-        $('#search_investigative').accordion({
-            heightStyle: "content"
-        });
-    }
-
-    function clearSearchView() {
-        if ($('#accordion').hasClass('ui-accordion')) {
-            $('#accordion').accordion('destroy');
-        }
-
-        if ($('#search_support').hasClass('ui-accordion')) {
-            $('#search_support').accordion('destroy');
-            $('#search_support').empty();
-        }
-
-        if ($('#search_detection').hasClass('ui-accordion')) {
-            $('#search_detection').accordion('destroy');
-            $('#search_detection').empty();
-        }
-
-        if ($('#search_contextual').hasClass('ui-accordion')) {
-            $('#search_contextual').accordion('destroy');
-            $('#search_contextual').empty();
-        }
-
-        if ($('#search_investigative').hasClass('ui-accordion')) {
-            $('#search_investigative').accordion('destroy');
-            $('#search_investigative').empty();
-        }
-
-        $('.configure_in_es').unbind("click");
-
-        let len = renderedComponents.length;
-        while (len--) {
-            let id = renderedComponents.pop();
-            mvc.Components.getInstance(id).dispose();
-        }
-    }
-
-    function getValueLabels(values, className) {
-        let cls = "";
-        if (className !== undefined || className) {
-            cls = className;
-        }
-        let valueArray = [];
-        if (values) {
-            if (typeof values === "string") {
-                valueArray.push(values)
-            } else {
-                valueArray = values;
-            }
-        }
-        let htmlTmpl = "";
-        valueArray.forEach(val => {
-            htmlTmpl += `<div class="value_label ${ cls }">${ val }</div>&nbsp;`
-        });
-
-        return htmlTmpl;
-    }
-});

dist/escu/appserver/static/escu_summary.css

@@ -1,66 +0,0 @@
-.btn-pill  {
-    display: inline;
-}
-
-.killchain-phases {
-    width: 100%;
-    margin-left: 6%;
-}
-
-.killchain_card {
-    width: 14%;
-    float:left;
-}
-
-.killchain {
-    height: 55px;
-    line-height: 55px;
-    -webkit-clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%);
-    clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%);
-}
-
-.killchain-text {
-    font-size: 300%;
-    font-weight: 600;
-    color: #fff;
-    text-align: center;
-    white-space: wrap;
-}
-
-
-.killchain-label {
-    margin-top: 7px;
-    text-align: center;
-    color: #666;
-    font-size: 14px;
-    font-weight: 700;
-    margin-left: 10%;
-    width: 60%;
-}
-
-.killchain-text-one-line {
-    font-size: 16px;
-    color: #fff;
-    font-family: system-ui;
-    white-space: wrap;
-    width: 100%;
-    padding-top: 7%;
-    padding-left: 26%;
-}
-
-.killchain-text-second {
-    font-size: 16px;
-    color: #fff;
-    font-family: system-ui;
-    margin-top: -10px;
-    padding-left: 26%;
-}
-
-.killchain-phases {
-    display: inline-block;
-    width: 100%;
-}
-
-.notfirst {
-    margin-left: -2%;
-}

dist/escu/appserver/static/escu_summary.js

@@ -1,76 +0,0 @@
-require([
-   'underscore',
-   'jquery',
-   'splunkjs/mvc',
-   'splunkjs/mvc/searchmanager',
-   '../app/DA-ESS-ContentUpdate/js/lib/tabs',
-   'css!../app/DA-ESS-ContentUpdate/js/lib/tabs.css',
-   'css!../app/DA-ESS-ContentUpdate/escu_summary.css',
-   'splunkjs/mvc/simplexml/ready!'
- ], function(_, $, mvc, SearchManager) {
-    $('.es-soc-analytic-story-stats').html(_.template('<%- _("Analytic Story Summary").t() %>'));
-    $('.es-soc-search-stats').html(_.template('<%- _("Search Summary").t() %>'));
-
-    const tokenModel = mvc.Components.get('default');
-    const submittedTokens = mvc.Components.get('submitted');
-
-    $.ajax({
-        url: Splunk.util.make_url('/splunkd/__raw/servicesNS/nobody/DA-ESS-ContentUpdate/apps/local'),
-        type: 'GET',
-        async: true,
-        data: {
-          output_mode: 'json',
-          count: -1,
-        },
-    }).done(result => {
-       if (result.entry) {
-        const foundEss = result.entry.find(app => app.name === 'SplunkEnterpriseSecuritySuite');
-        if (foundEss.content.version === "5.2.0") {
-          submittedTokens.set('explore-use-case-es-show', 'true');
-          const use_case_library_link = Splunk.util.make_url('app/SplunkEnterpriseSecuritySuite/ess_use_case_library');
-          const template = `<div class="alert alert-info"><i class="icon-alert" />
-                ${ _('Εxplore ESCU content updates directly from the Use Case Library within ES. To explore it, click').t() }
-                <a href="<%- use_case_library_link %>"> ${ _('here').t() }</a>.
-              </div>`;
-          $('#explore-use-case-es-info').html(_.template(template, { use_case_library_link: use_case_library_link }));
-        }
-      }
-    }).fail(err => {
-    });
-
-
-
-    // searchQuery -
-    let kcpSearch = new SearchManager({
-      id: "kcpSearch",
-      preview: true,
-      cache: true,
-      status_buckets: 300,
-      earliest_time: '-24h@h',
-      latest_time: 'now',
-      search: '| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | spath input=mappings path=kill_chain_phases{} output=kcp | stats count by kcp',
-    });
-
-    let results = kcpSearch.data("preview");
-
-    results.on("data", function() {
-      results.data().rows.forEach(row => {
-        let killchainID = '#' + row[0].toLowerCase().replace(/ /g,'');
-        $(killchainID).html(row[1]);
-      });
-    });
-
-    $('#analytic_filter_clear').on('click', function() {
-      tokenModel.set('form.as_cis', '*');
-      tokenModel.set('form.as_category', '*');
-      tokenModel.set('form.as_kill_chain_phase', '*');
-      tokenModel.set('form.as_data_models', '*');
-    });
-
-    $('#search_filter_clear').on('click', function() {
-      tokenModel.set('form.cis', '*');
-      tokenModel.set('form.searchtype', '*');
-      tokenModel.set('form.kill_chain_phase', '*');
-      tokenModel.set('form.data_models', '*');
-    });
- });

dist/escu/appserver/static/feedback.js

@@ -1,19 +0,0 @@
-
- require([
-   'underscore',
-   'jquery',
-   'splunkjs/mvc',
-   'splunkjs/mvc/simplexml/ready!'
- ], function(_, $, mvc, TableView) {
-
-   var defaultTokenSpace = mvc.Components.getInstance('default');
-
-   // This will take every textarea that has a data-token attribute and will make the given token with the value of the textarea
-   $('textarea[data-token]').each(function (textarea) {
-     $(this).on('input', function(input) {
-         var token_to_set = $(this).data('token');
-        defaultTokenSpace.set(token_to_set, $(this).val());
-     })
-   })
- });
-

dist/escu/appserver/static/js/lib/jquery-ui/AUTHORS.txt

@@ -1,333 +0,0 @@
-Authors ordered by first contribution
-A list of current team members is available at http://jqueryui.com/about
-
-Paul Bakaus <paul.bakaus@gmail.com>
-Richard Worth <rdworth@gmail.com>
-Yehuda Katz <wycats@gmail.com>
-Sean Catchpole <sean@sunsean.com>
-John Resig <jeresig@gmail.com>
-Tane Piper <piper.tane@gmail.com>
-Dmitri Gaskin <dmitrig01@gmail.com>
-Klaus Hartl <klaus.hartl@gmail.com>
-Stefan Petre <stefan.petre@gmail.com>
-Gilles van den Hoven <gilles@webunity.nl>
-Micheil Bryan Smith <micheil@brandedcode.com>
-Jörn Zaefferer <joern.zaefferer@gmail.com>
-Marc Grabanski <m@marcgrabanski.com>
-Keith Wood <kbwood@iinet.com.au>
-Brandon Aaron <brandon.aaron@gmail.com>
-Scott González <scott.gonzalez@gmail.com>
-Eduardo Lundgren <eduardolundgren@gmail.com>
-Aaron Eisenberger <aaronchi@gmail.com>
-Joan Piedra <theneojp@gmail.com>
-Bruno Basto <b.basto@gmail.com>
-Remy Sharp <remy@leftlogic.com>
-Bohdan Ganicky <bohdan.ganicky@gmail.com>
-David Bolter <david.bolter@gmail.com>
-Chi Cheng <cloudream@gmail.com>
-Ca-Phun Ung <pazu2k@gmail.com>
-Ariel Flesler <aflesler@gmail.com>
-Maggie Wachs <maggie@filamentgroup.com>
-Scott Jehl <scottjehl@gmail.com>
-Todd Parker <todd@filamentgroup.com>
-Andrew Powell <andrew@shellscape.org>
-Brant Burnett <btburnett3@gmail.com>
-Douglas Neiner <doug@dougneiner.com>
-Paul Irish <paul.irish@gmail.com>
-Ralph Whitbeck <ralph.whitbeck@gmail.com>
-Thibault Duplessis <thibault.duplessis@gmail.com>
-Dominique Vincent <dominique.vincent@toitl.com>
-Jack Hsu <jack.hsu@gmail.com>
-Adam Sontag <ajpiano@ajpiano.com>
-Carl Fürstenberg <carl@excito.com>
-Kevin Dalman <development@allpro.net>
-Alberto Fernández Capel <afcapel@gmail.com>
-Jacek Jędrzejewski (http://jacek.jedrzejewski.name)
-Ting Kuei <ting@kuei.com>
-Samuel Cormier-Iijima <sam@chide.it>
-Jon Palmer <jonspalmer@gmail.com>
-Ben Hollis <bhollis@amazon.com>
-Justin MacCarthy <Justin@Rubystars.biz>
-Eyal Kobrigo <kobrigo@hotmail.com>
-Tiago Freire <tiago.freire@gmail.com>
-Diego Tres <diegotres@gmail.com>
-Holger Rüprich <holger@rueprich.de>
-Ziling Zhao <zilingzhao@gmail.com>
-Mike Alsup <malsup@gmail.com>
-Robson Braga Araujo <robsonbraga@gmail.com>
-Pierre-Henri Ausseil <ph.ausseil@gmail.com>
-Christopher McCulloh <cmcculloh@gmail.com>
-Andrew Newcomb <ext.github@preceptsoftware.co.uk>
-Lim Chee Aun <cheeaun@gmail.com>
-Jorge Barreiro <yortx.barry@gmail.com>
-Daniel Steigerwald <daniel@steigerwald.cz>
-John Firebaugh <john_firebaugh@bigfix.com>
-John Enters <github@darkdark.net>
-Andrey Kapitcyn <ru.m157y@gmail.com>
-Dmitry Petrov <dpetroff@gmail.com>
-Eric Hynds <eric@hynds.net>
-Chairat Sunthornwiphat <pipo@sixhead.com>
-Josh Varner <josh.varner@gmail.com>
-Stéphane Raimbault <stephane.raimbault@gmail.com>
-Jay Merrifield <fracmak@gmail.com>
-J. Ryan Stinnett <jryans@gmail.com>
-Peter Heiberg <peter@heiberg.se>
-Alex Dovenmuehle <adovenmuehle@gmail.com>
-Jamie Gegerson <git@jamiegegerson.com>
-Raymond Schwartz <skeetergraphics@gmail.com>
-Phillip Barnes <philbar@gmail.com>
-Kyle Wilkinson <kai@wikyd.org>
-Khaled AlHourani <me@khaledalhourani.com>
-Marian Rudzynski <mr@impaled.org>
-Jean-Francois Remy <jeff@melix.org>
-Doug Blood <dougblood@gmail.com>
-Filippo Cavallarin <filippo.cavallarin@codseq.it>
-Heiko Henning <heiko@thehennings.ch>
-Aliaksandr Rahalevich <saksmlz@gmail.com>
-Mario Visic <mario@mariovisic.com>
-Xavi Ramirez <xavi.rmz@gmail.com>
-Max Schnur <max.schnur@gmail.com>
-Saji Nediyanchath <saji89@gmail.com>
-Corey Frang <gnarf37@gmail.com>
-Aaron Peterson <aaronp123@yahoo.com>
-Ivan Peters <ivan@ivanpeters.com>
-Mohamed Cherif Bouchelaghem <cherifbouchelaghem@yahoo.fr>
-Marcos Sousa <falecomigo@marcossousa.com>
-Michael DellaNoce <mdellanoce@mailtrust.com>
-George Marshall <echosx@gmail.com>
-Tobias Brunner <tobias@strongswan.org>
-Martin Solli <msolli@gmail.com>
-David Petersen <public@petersendidit.com>
-Dan Heberden <danheberden@gmail.com>
-William Kevin Manire <williamkmanire@gmail.com>
-Gilmore Davidson <gilmoreorless@gmail.com>
-Michael Wu <michaelmwu@gmail.com>
-Adam Parod <mystic414@gmail.com>
-Guillaume Gautreau <guillaume+github@ghusse.com>
-Marcel Toele <EleotleCram@gmail.com>
-Dan Streetman <ddstreet@ieee.org>
-Matt Hoskins <matt@nipltd.com>
-Giovanni Giacobbi <giovanni@giacobbi.net>
-Kyle Florence <kyle.florence@gmail.com>
-Pavol Hluchý <lopo@losys.sk>
-Hans Hillen <hans.hillen@gmail.com>
-Mark Johnson <virgofx@live.com>
-Trey Hunner <treyhunner@gmail.com>
-Shane Whittet <whittet@gmail.com>
-Edward A Faulkner <ef@alum.mit.edu>
-Adam Baratz <adam@adambaratz.com>
-Kato Kazuyoshi <kato.kazuyoshi@gmail.com>
-Eike Send <eike.send@gmail.com>
-Kris Borchers <kris.borchers@gmail.com>
-Eddie Monge <eddie@eddiemonge.com>
-Israel Tsadok <itsadok@gmail.com>
-Carson McDonald <carson@ioncannon.net>
-Jason Davies <jason@jasondavies.com>
-Garrison Locke <gplocke@gmail.com>
-David Murdoch <david@davidmurdoch.com>
-Benjamin Scott Boyle <benjamins.boyle@gmail.com>
-Jesse Baird <jebaird@gmail.com>
-Jonathan Vingiano <jvingiano@gmail.com>
-Dylan Just <dev@ephox.com>
-Hiroshi Tomita <tomykaira@gmail.com>
-Glenn Goodrich <glenn.goodrich@gmail.com>
-Tarafder Ashek-E-Elahi <mail.ashek@gmail.com>
-Ryan Neufeld <ryan@neufeldmail.com>
-Marc Neuwirth <marc.neuwirth@gmail.com>
-Philip Graham <philip.robert.graham@gmail.com>
-Benjamin Sterling <benjamin.sterling@kenzomedia.com>
-Wesley Walser <waw325@gmail.com>
-Kouhei Sutou <kou@clear-code.com>
-Karl Kirch <karlkrch@gmail.com>
-Chris Kelly <ckdake@ckdake.com>
-Jason Oster <jay@kodewerx.org>
-Felix Nagel <info@felixnagel.com>
-Alexander Polomoshnov <alex.polomoshnov@gmail.com>
-David Leal <dgleal@gmail.com>
-Igor Milla <igor.fsp.milla@gmail.com>
-Dave Methvin <dave.methvin@gmail.com>
-Florian Gutmann <f.gutmann@chronimo.com>
-Marwan Al Jubeh <marwan.aljubeh@gmail.com>
-Milan Broum <midlis@googlemail.com>
-Sebastian Sauer <info@dynpages.de>
-Gaëtan Muller <m.gaetan89@gmail.com>
-Michel Weimerskirch <michel@weimerskirch.net>
-William Griffiths <william@ycymro.com>
-Stojce Slavkovski <stojce@gmail.com>
-David Soms <david.soms@gmail.com>
-David De Sloovere <david.desloovere@outlook.com>
-Michael P. Jung <michael.jung@terreon.de>
-Shannon Pekary <spekary@gmail.com>
-Dan Wellman <danwellman@hotmail.com>
-Matthew Edward Hutton <meh@corefiling.co.uk>
-James Khoury <james@jameskhoury.com>
-Rob Loach <robloach@gmail.com>
-Alberto Monteiro <betimbrasil@gmail.com>
-Alex Rhea <alex.rhea@gmail.com>
-Krzysztof Rosiński <rozwell69@gmail.com>
-Ryan Olton <oltonr@gmail.com>
-Genie <386@mail.com>
-Rick Waldron <waldron.rick@gmail.com>
-Ian Simpson <spoonlikesham@gmail.com>
-Lev Kitsis <spam4lev@gmail.com>
-TJ VanToll <tj.vantoll@gmail.com>
-Justin Domnitz <jdomnitz@gmail.com>
-Douglas Cerna <douglascerna@yahoo.com>
-Bert ter Heide <bertjh@hotmail.com>
-Jasvir Nagra <jasvir@gmail.com>
-Yuriy Khabarov <13real008@gmail.com>
-Harri Kilpiö <harri.kilpio@gmail.com>
-Lado Lomidze <lado.lomidze@gmail.com>
-Amir E. Aharoni <amir.aharoni@mail.huji.ac.il>
-Simon Sattes <simon.sattes@gmail.com>
-Jo Liss <joliss42@gmail.com>
-Guntupalli Karunakar <karunakarg@yahoo.com>
-Shahyar Ghobadpour <shahyar@gmail.com>
-Lukasz Lipinski <uzza17@gmail.com>
-Timo Tijhof <krinklemail@gmail.com>
-Jason Moon <jmoon@socialcast.com>
-Martin Frost <martinf55@hotmail.com>
-Eneko Illarramendi <eneko@illarra.com>
-EungJun Yi <semtlenori@gmail.com>
-Courtland Allen <courtlandallen@gmail.com>
-Viktar Varvanovich <non4eg@gmail.com>
-Danny Trunk <dtrunk90@gmail.com>
-Pavel Stetina <pavel.stetina@nangu.tv>
-Michael Stay <metaweta@gmail.com>
-Steven Roussey <sroussey@gmail.com>
-Michael Hollis <hollis21@gmail.com>
-Lee Rowlands <lee.rowlands@previousnext.com.au>
-Timmy Willison <timmywillisn@gmail.com>
-Karl Swedberg <kswedberg@gmail.com>
-Baoju Yuan <the_guy_1987@hotmail.com>
-Maciej Mroziński <maciej.k.mrozinski@gmail.com>
-Luis Dalmolin <luis.nh@gmail.com>
-Mark Aaron Shirley <maspwr@gmail.com>
-Martin Hoch <martin@fidion.de>
-Jiayi Yang <tr870829@gmail.com>
-Philipp Benjamin Köppchen <xgxtpbk@gws.ms>
-Sindre Sorhus <sindresorhus@gmail.com>
-Bernhard Sirlinger <bernhard.sirlinger@tele2.de>
-Jared A. Scheel <jared@jaredscheel.com>
-Rafael Xavier de Souza <rxaviers@gmail.com>
-John Chen <zhang.z.chen@intel.com>
-Robert Beuligmann <robertbeuligmann@gmail.com>
-Dale Kocian <dale.kocian@gmail.com>
-Mike Sherov <mike.sherov@gmail.com>
-Andrew Couch <andy@couchand.com>
-Marc-Andre Lafortune <github@marc-andre.ca>
-Nate Eagle <nate.eagle@teamaol.com>
-David Souther <davidsouther@gmail.com>
-Mathias Stenbom <mathias@stenbom.com>
-Sergey Kartashov <ebishkek@yandex.ru>
-Avinash R <nashpapa@gmail.com>
-Ethan Romba <ethanromba@gmail.com>
-Cory Gackenheimer <cory.gack@gmail.com>
-Juan Pablo Kaniefsky <jpkaniefsky@gmail.com>
-Roman Salnikov <bardt.dz@gmail.com>
-Anika Henke <anika@selfthinker.org>
-Samuel Bovée <samycookie2000@yahoo.fr>
-Fabrício Matté <ult_combo@hotmail.com>
-Viktor Kojouharov <vkojouharov@gmail.com>
-Pawel Maruszczyk (http://hrabstwo.net)
-Pavel Selitskas <p.selitskas@gmail.com>
-Bjørn Johansen <post@bjornjohansen.no>
-Matthieu Penant <thieum22@hotmail.com>
-Dominic Barnes <dominic@dbarnes.info>
-David Sullivan <david.sullivan@gmail.com>
-Thomas Jaggi <thomas@responsive.ch>
-Vahid Sohrabloo <vahid4134@gmail.com>
-Travis Carden <travis.carden@gmail.com>
-Bruno M. Custódio <bruno@brunomcustodio.com>
-Nathanael Silverman <nathanael.silverman@gmail.com>
-Christian Wenz <christian@wenz.org>
-Steve Urmston <steve@urm.st>
-Zaven Muradyan <megalivoithos@gmail.com>
-Woody Gilk <shadowhand@deviantart.com>
-Zbigniew Motyka <zbigniew.motyka@gmail.com>
-Suhail Alkowaileet <xsoh.k7@gmail.com>
-Toshi MARUYAMA <marutosijp2@yahoo.co.jp>
-David Hansen <hansede@gmail.com>
-Brian Grinstead <briangrinstead@gmail.com>
-Christian Klammer <christian314159@gmail.com>
-Steven Luscher <jquerycla@steveluscher.com>
-Gan Eng Chin <engchin.gan@gmail.com>
-Gabriel Schulhof <gabriel.schulhof@intel.com>
-Alexander Schmitz <arschmitz@gmail.com>
-Vilhjálmur Skúlason <vis@dmm.is>
-Siebrand Mazeland <siebrand@kitano.nl>
-Mohsen Ekhtiari <mohsenekhtiari@yahoo.com>
-Pere Orga <gotrunks@gmail.com>
-Jasper de Groot <mail@ugomobi.com>
-Stephane Deschamps <stephane.deschamps@gmail.com>
-Jyoti Deka <dekajp@gmail.com>
-Andrei Picus <office.nightcrawler@gmail.com>
-Ondrej Novy <novy@ondrej.org>
-Jacob McCutcheon <jacob.mccutcheon@gmail.com>
-Monika Piotrowicz <monika.piotrowicz@gmail.com>
-Imants Horsts <imants.horsts@inbox.lv>
-Eric Dahl <eric.c.dahl@gmail.com>
-Dave Stein <dave@behance.com>
-Dylan Barrell <dylan@barrell.com>
-Daniel DeGroff <djdegroff@gmail.com>
-Michael Wiencek <mwtuea@gmail.com>
-Thomas Meyer <meyertee@gmail.com>
-Ruslan Yakhyaev <ruslan@ruslan.io>
-Brian J. Dowling <bjd-dev@simplicity.net>
-Ben Higgins <ben@extrahop.com>
-Yermo Lamers <yml@yml.com>
-Patrick Stapleton <github@gdi2290.com>
-Trisha Crowley <trisha.crowley@gmail.com>
-Usman Akeju <akeju00+github@gmail.com>
-Rodrigo Menezes <rod333@gmail.com>
-Jacques Perrault <jacques_perrault@us.ibm.com>
-Frederik Elvhage <frederik.elvhage@googlemail.com>
-Will Holley <willholley@gmail.com>
-Uri Gilad <antishok@gmail.com>
-Richard Gibson <richard.gibson@gmail.com>
-Simen Bekkhus <sbekkhus91@gmail.com>
-Chen Eshchar <eshcharc@gmail.com>
-Bruno Pérel <brunoperel@gmail.com>
-Mohammed Alshehri <m@dralshehri.com>
-Lisa Seacat DeLuca <ldeluca@us.ibm.com>
-Anne-Gaelle Colom <coloma@westminster.ac.uk>
-Adam Foster <slimfoster@gmail.com>
-Luke Page <luke.a.page@gmail.com>
-Daniel Owens <daniel@matchstickmixup.com>
-Michael Orchard <morchard@scottlogic.co.uk>
-Marcus Warren <marcus@envoke.com>
-Nils Heuermann <nils@world-of-scripts.de>
-Marco Ziech <marco@ziech.net>
-Patricia Juarez <patrixd@gmail.com>
-Ben Mosher <me@benmosher.com>
-Ablay Keldibek <atomio.ak@gmail.com>
-Thomas Applencourt <thomas.applencourt@irsamc.ups-tlse.fr>
-Jiabao Wu <jiabao.foss@gmail.com>
-Eric Lee Carraway <github@ericcarraway.com>
-Victor Homyakov <vkhomyackov@gmail.com>
-Myeongjin Lee <aranet100@gmail.com>
-Liran Sharir <lsharir@gmail.com>
-Weston Ruter <weston@xwp.co>
-Mani Mishra <manimishra902@gmail.com>
-Hannah Methvin <hannahmethvin@gmail.com>
-Leonardo Balter <leonardo.balter@gmail.com>
-Benjamin Albert <benjamin_a5@yahoo.com>
-Michał Gołębiowski <m.goleb@gmail.com>
-Alyosha Pushak <alyosha.pushak@gmail.com>
-Fahad Ahmad <fahadahmad41@hotmail.com>
-Matt Brundage <github@mattbrundage.com>
-Francesc Baeta <francesc.baeta@gmail.com>
-Piotr Baran <piotros@wp.pl>
-Mukul Hase <mukulhase@gmail.com>
-Konstantin Dinev <kdinev@mail.bw.edu>
-Rand Scullard <rand@randscullard.com>
-Dan Strohl <dan@wjcg.net>
-Maksim Ryzhikov <rv.maksim@gmail.com>
-Amine HADDAD <haddad@allegorie.tv>
-Amanpreet Singh <apsdehal@gmail.com>
-Alexey Balchunas <bleshik@gmail.com>
-Peter Kehl <peter.kehl@gmail.com>
-Peter Dave Hello <hsu@peterdavehello.org>
-Johannes Schäfer <johnschaefer@gmx.de>
-Ville Skyttä <ville.skytta@iki.fi>
-Ryan Oriecuia <ryan.oriecuia@visioncritical.com>

dist/escu/appserver/static/js/lib/jquery-ui/LICENSE.txt

@@ -1,43 +0,0 @@
-Copyright jQuery Foundation and other contributors, https://jquery.org/
-
-This software consists of voluntary contributions made by many
-individuals. For exact contribution history, see the revision history
-available at https://github.com/jquery/jquery-ui
-
-The following license applies to all parts of this software except as
-documented below:
-
-====
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-====
-
-Copyright and related rights for sample code are waived via CC0. Sample
-code is defined as all source code contained within the demos directory.
-
-CC0: http://creativecommons.org/publicdomain/zero/1.0/
-
-====
-
-All files located in the node_modules and external directories are
-externally maintained libraries used by this software which have their
-own licenses; we recommend you read them, as their terms may differ from
-the terms above.

dist/escu/appserver/static/js/lib/jquery-ui/index.html

@@ -1,559 +0,0 @@
-<!doctype html>
-<html lang="us">
-<head>
-	<meta charset="utf-8">
-	<title>jQuery UI Example Page</title>
-	<link href="jquery-ui.css" rel="stylesheet">
-	<style>
-	body{
-		font-family: "Trebuchet MS", sans-serif;
-		margin: 50px;
-	}
-	.demoHeaders {
-		margin-top: 2em;
-	}
-	#dialog-link {
-		padding: .4em 1em .4em 20px;
-		text-decoration: none;
-		position: relative;
-	}
-	#dialog-link span.ui-icon {
-		margin: 0 5px 0 0;
-		position: absolute;
-		left: .2em;
-		top: 50%;
-		margin-top: -8px;
-	}
-	#icons {
-		margin: 0;
-		padding: 0;
-	}
-	#icons li {
-		margin: 2px;
-		position: relative;
-		padding: 4px 0;
-		cursor: pointer;
-		float: left;
-		list-style: none;
-	}
-	#icons span.ui-icon {
-		float: left;
-		margin: 0 4px;
-	}
-	.fakewindowcontain .ui-widget-overlay {
-		position: absolute;
-	}
-	select {
-		width: 200px;
-	}
-	</style>
-</head>
-<body>
-
-<h1>Welcome to jQuery UI!</h1>
-
-<div class="ui-widget">
-	<p>This page demonstrates the widgets and theme you selected in Download Builder. Please make sure you are using them with a compatible jQuery version.</p>
-</div>
-
-<h1>YOUR COMPONENTS:</h1>
-
-
-<!-- Accordion -->
-<h2 class="demoHeaders">Accordion</h2>
-<div id="accordion">
-	<h3>First</h3>
-	<div>Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet.</div>
-	<h3>Second</h3>
-	<div>Phasellus mattis tincidunt nibh.</div>
-	<h3>Third</h3>
-	<div>Nam dui erat, auctor a, dignissim quis.</div>
-</div>
-
-
-
-<!-- Autocomplete -->
-<h2 class="demoHeaders">Autocomplete</h2>
-<div>
-	<input id="autocomplete" title="type &quot;a&quot;">
-</div>
-
-
-
-<!-- Button -->
-<h2 class="demoHeaders">Button</h2>
-<button id="button">A button element</button>
-<button id="button-icon">An icon-only button</button>
-
-
-
-<!-- Checkboxradio -->
-<h2 class="demoHeaders">Checkboxradio</h2>
-<form style="margin-top: 1em;">
-	<div id="radioset">
-		<input type="radio" id="radio1" name="radio"><label for="radio1">Choice 1</label>
-		<input type="radio" id="radio2" name="radio" checked="checked"><label for="radio2">Choice 2</label>
-		<input type="radio" id="radio3" name="radio"><label for="radio3">Choice 3</label>
-	</div>
-</form>
-
-
-
-<!-- Controlgroup -->
-<h2 class="demoHeaders">Controlgroup</h2>
-<fieldset>
-	<legend>Rental Car</legend>
-	<div id="controlgroup">
-		<select id="car-type">
-			<option>Compact car</option>
-			<option>Midsize car</option>
-			<option>Full size car</option>
-			<option>SUV</option>
-			<option>Luxury</option>
-			<option>Truck</option>
-			<option>Van</option>
-		</select>
-		<label for="transmission-standard">Standard</label>
-		<input type="radio" name="transmission" id="transmission-standard">
-		<label for="transmission-automatic">Automatic</label>
-		<input type="radio" name="transmission" id="transmission-automatic">
-		<label for="insurance">Insurance</label>
-		<input type="checkbox" name="insurance" id="insurance">
-		<label for="horizontal-spinner" class="ui-controlgroup-label"># of cars</label>
-		<input id="horizontal-spinner" class="ui-spinner-input">
-		<button>Book Now!</button>
-	</div>
-</fieldset>
-
-
-
-<!-- Tabs -->
-<h2 class="demoHeaders">Tabs</h2>
-<div id="tabs">
-	<ul>
-		<li><a href="#tabs-1">First</a></li>
-		<li><a href="#tabs-2">Second</a></li>
-		<li><a href="#tabs-3">Third</a></li>
-	</ul>
-	<div id="tabs-1">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</div>
-	<div id="tabs-2">Phasellus mattis tincidunt nibh. Cras orci urna, blandit id, pretium vel, aliquet ornare, felis. Maecenas scelerisque sem non nisl. Fusce sed lorem in enim dictum bibendum.</div>
-	<div id="tabs-3">Nam dui erat, auctor a, dignissim quis, sollicitudin eu, felis. Pellentesque nisi urna, interdum eget, sagittis et, consequat vestibulum, lacus. Mauris porttitor ullamcorper augue.</div>
-</div>
-
-
-
-<h2 class="demoHeaders">Dialog</h2>
-<p>
-	<button id="dialog-link" class="ui-button ui-corner-all ui-widget">
-		<span class="ui-icon ui-icon-newwin"></span>Open Dialog
-	</button>
-</p>
-
-<h2 class="demoHeaders">Overlay and Shadow Classes</h2>
-<div style="position: relative; width: 96%; height: 200px; padding:1% 2%; overflow:hidden;" class="fakewindowcontain">
-	<p>Lorem ipsum dolor sit amet,  Nulla nec tortor. Donec id elit quis purus consectetur consequat. </p><p>Nam congue semper tellus. Sed erat dolor, dapibus sit amet, venenatis ornare, ultrices ut, nisi. Aliquam ante. Suspendisse scelerisque dui nec velit. Duis augue augue, gravida euismod, vulputate ac, facilisis id, sem. Morbi in orci. </p><p>Nulla purus lacus, pulvinar vel, malesuada ac, mattis nec, quam. Nam molestie scelerisque quam. Nullam feugiat cursus lacus.orem ipsum dolor sit amet, consectetur adipiscing elit. Donec libero risus, commodo vitae, pharetra mollis, posuere eu, pede. Nulla nec tortor. Donec id elit quis purus consectetur consequat. </p><p>Nam congue semper tellus. Sed erat dolor, dapibus sit amet, venenatis ornare, ultrices ut, nisi. Aliquam ante. Suspendisse scelerisque dui nec velit. Duis augue augue, gravida euismod, vulputate ac, facilisis id, sem. Morbi in orci. Nulla purus lacus, pulvinar vel, malesuada ac, mattis nec, quam. Nam molestie scelerisque quam. </p><p>Nullam feugiat cursus lacus.orem ipsum dolor sit amet, consectetur adipiscing elit. Donec libero risus, commodo vitae, pharetra mollis, posuere eu, pede. Nulla nec tortor. Donec id elit quis purus consectetur consequat. Nam congue semper tellus. Sed erat dolor, dapibus sit amet, venenatis ornare, ultrices ut, nisi. Aliquam ante. </p><p>Suspendisse scelerisque dui nec velit. Duis augue augue, gravida euismod, vulputate ac, facilisis id, sem. Morbi in orci. Nulla purus lacus, pulvinar vel, malesuada ac, mattis nec, quam. Nam molestie scelerisque quam. Nullam feugiat cursus lacus.orem ipsum dolor sit amet, consectetur adipiscing elit. Donec libero risus, commodo vitae, pharetra mollis, posuere eu, pede. Nulla nec tortor. Donec id elit quis purus consectetur consequat. Nam congue semper tellus. Sed erat dolor, dapibus sit amet, venenatis ornare, ultrices ut, nisi. </p>
-
-	<!-- ui-dialog -->
-	<div class="ui-widget-overlay ui-front"></div>
-	<div style="position: absolute; width: 320px; left: 50px; top: 30px; padding: 1.2em" class="ui-widget ui-front ui-widget-content ui-corner-all ui-widget-shadow">
-		Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.
-	</div>
-
-</div>
-
-<!-- ui-dialog -->
-<div id="dialog" title="Dialog Title">
-	<p>Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</p>
-</div>
-
-
-
-<h2 class="demoHeaders">Framework Icons (content color preview)</h2>
-<ul id="icons" class="ui-widget ui-helper-clearfix">
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-n"><span class="ui-icon ui-icon-caret-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-ne"><span class="ui-icon ui-icon-caret-1-ne"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-e"><span class="ui-icon ui-icon-caret-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-se"><span class="ui-icon ui-icon-caret-1-se"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-s"><span class="ui-icon ui-icon-caret-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-sw"><span class="ui-icon ui-icon-caret-1-sw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-w"><span class="ui-icon ui-icon-caret-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-1-nw"><span class="ui-icon ui-icon-caret-1-nw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-2-n-s"><span class="ui-icon ui-icon-caret-2-n-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-caret-2-e-w"><span class="ui-icon ui-icon-caret-2-e-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-n"><span class="ui-icon ui-icon-triangle-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-ne"><span class="ui-icon ui-icon-triangle-1-ne"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-e"><span class="ui-icon ui-icon-triangle-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-se"><span class="ui-icon ui-icon-triangle-1-se"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-s"><span class="ui-icon ui-icon-triangle-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-sw"><span class="ui-icon ui-icon-triangle-1-sw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-w"><span class="ui-icon ui-icon-triangle-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-1-nw"><span class="ui-icon ui-icon-triangle-1-nw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-2-n-s"><span class="ui-icon ui-icon-triangle-2-n-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-triangle-2-e-w"><span class="ui-icon ui-icon-triangle-2-e-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-n"><span class="ui-icon ui-icon-arrow-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-ne"><span class="ui-icon ui-icon-arrow-1-ne"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-e"><span class="ui-icon ui-icon-arrow-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-se"><span class="ui-icon ui-icon-arrow-1-se"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-s"><span class="ui-icon ui-icon-arrow-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-sw"><span class="ui-icon ui-icon-arrow-1-sw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-w"><span class="ui-icon ui-icon-arrow-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-1-nw"><span class="ui-icon ui-icon-arrow-1-nw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-2-n-s"><span class="ui-icon ui-icon-arrow-2-n-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-2-ne-sw"><span class="ui-icon ui-icon-arrow-2-ne-sw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-2-e-w"><span class="ui-icon ui-icon-arrow-2-e-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-2-se-nw"><span class="ui-icon ui-icon-arrow-2-se-nw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowstop-1-n"><span class="ui-icon ui-icon-arrowstop-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowstop-1-e"><span class="ui-icon ui-icon-arrowstop-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowstop-1-s"><span class="ui-icon ui-icon-arrowstop-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowstop-1-w"><span class="ui-icon ui-icon-arrowstop-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-n"><span class="ui-icon ui-icon-arrowthick-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-ne"><span class="ui-icon ui-icon-arrowthick-1-ne"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-e"><span class="ui-icon ui-icon-arrowthick-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-se"><span class="ui-icon ui-icon-arrowthick-1-se"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-s"><span class="ui-icon ui-icon-arrowthick-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-sw"><span class="ui-icon ui-icon-arrowthick-1-sw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-w"><span class="ui-icon ui-icon-arrowthick-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-1-nw"><span class="ui-icon ui-icon-arrowthick-1-nw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-2-n-s"><span class="ui-icon ui-icon-arrowthick-2-n-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-2-ne-sw"><span class="ui-icon ui-icon-arrowthick-2-ne-sw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-2-e-w"><span class="ui-icon ui-icon-arrowthick-2-e-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthick-2-se-nw"><span class="ui-icon ui-icon-arrowthick-2-se-nw"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthickstop-1-n"><span class="ui-icon ui-icon-arrowthickstop-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthickstop-1-e"><span class="ui-icon ui-icon-arrowthickstop-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthickstop-1-s"><span class="ui-icon ui-icon-arrowthickstop-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowthickstop-1-w"><span class="ui-icon ui-icon-arrowthickstop-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturnthick-1-w"><span class="ui-icon ui-icon-arrowreturnthick-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturnthick-1-n"><span class="ui-icon ui-icon-arrowreturnthick-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturnthick-1-e"><span class="ui-icon ui-icon-arrowreturnthick-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturnthick-1-s"><span class="ui-icon ui-icon-arrowreturnthick-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturn-1-w"><span class="ui-icon ui-icon-arrowreturn-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturn-1-n"><span class="ui-icon ui-icon-arrowreturn-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturn-1-e"><span class="ui-icon ui-icon-arrowreturn-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowreturn-1-s"><span class="ui-icon ui-icon-arrowreturn-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowrefresh-1-w"><span class="ui-icon ui-icon-arrowrefresh-1-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowrefresh-1-n"><span class="ui-icon ui-icon-arrowrefresh-1-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowrefresh-1-e"><span class="ui-icon ui-icon-arrowrefresh-1-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrowrefresh-1-s"><span class="ui-icon ui-icon-arrowrefresh-1-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-4"><span class="ui-icon ui-icon-arrow-4"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-arrow-4-diag"><span class="ui-icon ui-icon-arrow-4-diag"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-extlink"><span class="ui-icon ui-icon-extlink"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-newwin"><span class="ui-icon ui-icon-newwin"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-refresh"><span class="ui-icon ui-icon-refresh"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-shuffle"><span class="ui-icon ui-icon-shuffle"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-transfer-e-w"><span class="ui-icon ui-icon-transfer-e-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-transferthick-e-w"><span class="ui-icon ui-icon-transferthick-e-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-folder-collapsed"><span class="ui-icon ui-icon-folder-collapsed"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-folder-open"><span class="ui-icon ui-icon-folder-open"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-document"><span class="ui-icon ui-icon-document"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-document-b"><span class="ui-icon ui-icon-document-b"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-note"><span class="ui-icon ui-icon-note"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-mail-closed"><span class="ui-icon ui-icon-mail-closed"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-mail-open"><span class="ui-icon ui-icon-mail-open"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-suitcase"><span class="ui-icon ui-icon-suitcase"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-comment"><span class="ui-icon ui-icon-comment"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-person"><span class="ui-icon ui-icon-person"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-print"><span class="ui-icon ui-icon-print"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-trash"><span class="ui-icon ui-icon-trash"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-locked"><span class="ui-icon ui-icon-locked"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-unlocked"><span class="ui-icon ui-icon-unlocked"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-bookmark"><span class="ui-icon ui-icon-bookmark"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-tag"><span class="ui-icon ui-icon-tag"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-home"><span class="ui-icon ui-icon-home"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-flag"><span class="ui-icon ui-icon-flag"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-calculator"><span class="ui-icon ui-icon-calculator"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-cart"><span class="ui-icon ui-icon-cart"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-pencil"><span class="ui-icon ui-icon-pencil"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-clock"><span class="ui-icon ui-icon-clock"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-disk"><span class="ui-icon ui-icon-disk"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-calendar"><span class="ui-icon ui-icon-calendar"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-zoomin"><span class="ui-icon ui-icon-zoomin"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-zoomout"><span class="ui-icon ui-icon-zoomout"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-search"><span class="ui-icon ui-icon-search"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-wrench"><span class="ui-icon ui-icon-wrench"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-gear"><span class="ui-icon ui-icon-gear"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-heart"><span class="ui-icon ui-icon-heart"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-star"><span class="ui-icon ui-icon-star"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-link"><span class="ui-icon ui-icon-link"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-cancel"><span class="ui-icon ui-icon-cancel"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-plus"><span class="ui-icon ui-icon-plus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-plusthick"><span class="ui-icon ui-icon-plusthick"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-minus"><span class="ui-icon ui-icon-minus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-minusthick"><span class="ui-icon ui-icon-minusthick"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-close"><span class="ui-icon ui-icon-close"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-closethick"><span class="ui-icon ui-icon-closethick"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-key"><span class="ui-icon ui-icon-key"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-lightbulb"><span class="ui-icon ui-icon-lightbulb"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-scissors"><span class="ui-icon ui-icon-scissors"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-clipboard"><span class="ui-icon ui-icon-clipboard"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-copy"><span class="ui-icon ui-icon-copy"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-contact"><span class="ui-icon ui-icon-contact"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-image"><span class="ui-icon ui-icon-image"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-video"><span class="ui-icon ui-icon-video"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-script"><span class="ui-icon ui-icon-script"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-alert"><span class="ui-icon ui-icon-alert"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-info"><span class="ui-icon ui-icon-info"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-notice"><span class="ui-icon ui-icon-notice"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-help"><span class="ui-icon ui-icon-help"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-check"><span class="ui-icon ui-icon-check"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-bullet"><span class="ui-icon ui-icon-bullet"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-radio-off"><span class="ui-icon ui-icon-radio-off"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-radio-on"><span class="ui-icon ui-icon-radio-on"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-pin-w"><span class="ui-icon ui-icon-pin-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-pin-s"><span class="ui-icon ui-icon-pin-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-play"><span class="ui-icon ui-icon-play"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-pause"><span class="ui-icon ui-icon-pause"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-seek-next"><span class="ui-icon ui-icon-seek-next"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-seek-prev"><span class="ui-icon ui-icon-seek-prev"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-seek-end"><span class="ui-icon ui-icon-seek-end"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-seek-first"><span class="ui-icon ui-icon-seek-first"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-stop"><span class="ui-icon ui-icon-stop"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-eject"><span class="ui-icon ui-icon-eject"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-volume-off"><span class="ui-icon ui-icon-volume-off"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-volume-on"><span class="ui-icon ui-icon-volume-on"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-power"><span class="ui-icon ui-icon-power"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-signal-diag"><span class="ui-icon ui-icon-signal-diag"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-signal"><span class="ui-icon ui-icon-signal"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-battery-0"><span class="ui-icon ui-icon-battery-0"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-battery-1"><span class="ui-icon ui-icon-battery-1"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-battery-2"><span class="ui-icon ui-icon-battery-2"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-battery-3"><span class="ui-icon ui-icon-battery-3"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-plus"><span class="ui-icon ui-icon-circle-plus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-minus"><span class="ui-icon ui-icon-circle-minus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-close"><span class="ui-icon ui-icon-circle-close"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-triangle-e"><span class="ui-icon ui-icon-circle-triangle-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-triangle-s"><span class="ui-icon ui-icon-circle-triangle-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-triangle-w"><span class="ui-icon ui-icon-circle-triangle-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-triangle-n"><span class="ui-icon ui-icon-circle-triangle-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-arrow-e"><span class="ui-icon ui-icon-circle-arrow-e"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-arrow-s"><span class="ui-icon ui-icon-circle-arrow-s"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-arrow-w"><span class="ui-icon ui-icon-circle-arrow-w"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-arrow-n"><span class="ui-icon ui-icon-circle-arrow-n"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-zoomin"><span class="ui-icon ui-icon-circle-zoomin"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-zoomout"><span class="ui-icon ui-icon-circle-zoomout"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circle-check"><span class="ui-icon ui-icon-circle-check"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circlesmall-plus"><span class="ui-icon ui-icon-circlesmall-plus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circlesmall-minus"><span class="ui-icon ui-icon-circlesmall-minus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-circlesmall-close"><span class="ui-icon ui-icon-circlesmall-close"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-squaresmall-plus"><span class="ui-icon ui-icon-squaresmall-plus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-squaresmall-minus"><span class="ui-icon ui-icon-squaresmall-minus"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-squaresmall-close"><span class="ui-icon ui-icon-squaresmall-close"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-grip-dotted-vertical"><span class="ui-icon ui-icon-grip-dotted-vertical"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-grip-dotted-horizontal"><span class="ui-icon ui-icon-grip-dotted-horizontal"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-grip-solid-vertical"><span class="ui-icon ui-icon-grip-solid-vertical"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-grip-solid-horizontal"><span class="ui-icon ui-icon-grip-solid-horizontal"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-gripsmall-diagonal-se"><span class="ui-icon ui-icon-gripsmall-diagonal-se"></span></li>
-	<li class="ui-state-default ui-corner-all" title=".ui-icon-grip-diagonal-se"><span class="ui-icon ui-icon-grip-diagonal-se"></span></li>
-</ul>
-
-
-<!-- Slider -->
-<h2 class="demoHeaders">Slider</h2>
-<div id="slider"></div>
-
-
-
-<!-- Datepicker -->
-<h2 class="demoHeaders">Datepicker</h2>
-<div id="datepicker"></div>
-
-
-
-<!-- Progressbar -->
-<h2 class="demoHeaders">Progressbar</h2>
-<div id="progressbar"></div>
-
-
-
-<!-- Progressbar -->
-<h2 class="demoHeaders">Selectmenu</h2>
-<select id="selectmenu">
-	<option>Slower</option>
-	<option>Slow</option>
-	<option selected="selected">Medium</option>
-	<option>Fast</option>
-	<option>Faster</option>
-</select>
-
-
-
-<!-- Spinner -->
-<h2 class="demoHeaders">Spinner</h2>
-<input id="spinner">
-
-
-
-<!-- Menu -->
-<h2 class="demoHeaders">Menu</h2>
-<ul style="width:100px;" id="menu">
-	<li><div>Item 1</div></li>
-	<li><div>Item 2</div></li>
-	<li><div>Item 3</div>
-		<ul>
-			<li><div>Item 3-1</div></li>
-			<li><div>Item 3-2</div></li>
-			<li><div>Item 3-3</div></li>
-			<li><div>Item 3-4</div></li>
-			<li><div>Item 3-5</div></li>
-		</ul>
-	</li>
-	<li><div>Item 4</div></li>
-	<li><div>Item 5</div></li>
-</ul>
-
-
-
-<!-- Tooltip -->
-<h2 class="demoHeaders">Tooltip</h2>
-<p id="tooltip">
-	<a href="#" title="That&apos;s what this widget is">Tooltips</a> can be attached to any element. When you hover
-the element with your mouse, the title attribute is displayed in a little box next to the element, just like a native tooltip.
-</p>
-
-
-<!-- Highlight / Error -->
-<h2 class="demoHeaders">Highlight / Error</h2>
-<div class="ui-widget">
-	<div class="ui-state-highlight ui-corner-all" style="margin-top: 20px; padding: 0 .7em;">
-		<p><span class="ui-icon ui-icon-info" style="float: left; margin-right: .3em;"></span>
-		<strong>Hey!</strong> Sample ui-state-highlight style.</p>
-	</div>
-</div>
-<br>
-<div class="ui-widget">
-	<div class="ui-state-error ui-corner-all" style="padding: 0 .7em;">
-		<p><span class="ui-icon ui-icon-alert" style="float: left; margin-right: .3em;"></span>
-		<strong>Alert:</strong> Sample ui-state-error style.</p>
-	</div>
-</div>
-
-<script src="external/jquery/jquery.js"></script>
-<script src="jquery-ui.js"></script>
-<script>
-
-$( "#accordion" ).accordion();
-
-
-
-var availableTags = [
-	"ActionScript",
-	"AppleScript",
-	"Asp",
-	"BASIC",
-	"C",
-	"C++",
-	"Clojure",
-	"COBOL",
-	"ColdFusion",
-	"Erlang",
-	"Fortran",
-	"Groovy",
-	"Haskell",
-	"Java",
-	"JavaScript",
-	"Lisp",
-	"Perl",
-	"PHP",
-	"Python",
-	"Ruby",
-	"Scala",
-	"Scheme"
-];
-$( "#autocomplete" ).autocomplete({
-	source: availableTags
-});
-
-
-
-$( "#button" ).button();
-$( "#button-icon" ).button({
-	icon: "ui-icon-gear",
-	showLabel: false
-});
-
-
-
-$( "#radioset" ).buttonset();
-
-
-
-$( "#controlgroup" ).controlgroup();
-
-
-
-$( "#tabs" ).tabs();
-
-
-
-$( "#dialog" ).dialog({
-	autoOpen: false,
-	width: 400,
-	buttons: [
-		{
-			text: "Ok",
-			click: function() {
-				$( this ).dialog( "close" );
-			}
-		},
-		{
-			text: "Cancel",
-			click: function() {
-				$( this ).dialog( "close" );
-			}
-		}
-	]
-});
-
-// Link to open the dialog
-$( "#dialog-link" ).click(function( event ) {
-	$( "#dialog" ).dialog( "open" );
-	event.preventDefault();
-});
-
-
-
-$( "#datepicker" ).datepicker({
-	inline: true
-});
-
-
-
-$( "#slider" ).slider({
-	range: true,
-	values: [ 17, 67 ]
-});
-
-
-
-$( "#progressbar" ).progressbar({
-	value: 20
-});
-
-
-
-$( "#spinner" ).spinner();
-
-
-
-$( "#menu" ).menu();
-
-
-
-$( "#tooltip" ).tooltip();
-
-
-
-$( "#selectmenu" ).selectmenu();
-
-
-// Hover states on the static widgets
-$( "#dialog-link, #icons li" ).hover(
-	function() {
-		$( this ).addClass( "ui-state-hover" );
-	},
-	function() {
-		$( this ).removeClass( "ui-state-hover" );
-	}
-);
-</script>
-</body>
-</html>

dist/escu/appserver/static/js/lib/jquery-ui/jquery-ui.structure.css

@@ -1,886 +0,0 @@
-/*!
- * jQuery UI CSS Framework 1.12.1
- * http://jqueryui.com
- *
- * Copyright jQuery Foundation and other contributors
- * Released under the MIT license.
- * http://jquery.org/license
- *
- * http://api.jqueryui.com/category/theming/
- */
-.ui-draggable-handle {
-	-ms-touch-action: none;
-	touch-action: none;
-}
-/* Layout helpers
-----------------------------------*/
-.ui-helper-hidden {
-	display: none;
-}
-.ui-helper-hidden-accessible {
-	border: 0;
-	clip: rect(0 0 0 0);
-	height: 1px;
-	margin: -1px;
-	overflow: hidden;
-	padding: 0;
-	position: absolute;
-	width: 1px;
-}
-.ui-helper-reset {
-	margin: 0;
-	padding: 0;
-	border: 0;
-	outline: 0;
-	line-height: 1.3;
-	text-decoration: none;
-	font-size: 100%;
-	list-style: none;
-}
-.ui-helper-clearfix:before,
-.ui-helper-clearfix:after {
-	content: "";
-	display: table;
-	border-collapse: collapse;
-}
-.ui-helper-clearfix:after {
-	clear: both;
-}
-.ui-helper-zfix {
-	width: 100%;
-	height: 100%;
-	top: 0;
-	left: 0;
-	position: absolute;
-	opacity: 0;
-	filter:Alpha(Opacity=0); /* support: IE8 */
-}
-
-.ui-front {
-	z-index: 100;
-}
-
-
-/* Interaction Cues
-----------------------------------*/
-.ui-state-disabled {
-	cursor: default !important;
-	pointer-events: none;
-}
-
-
-/* Icons
-----------------------------------*/
-.ui-icon {
-	display: inline-block;
-	vertical-align: middle;
-	margin-top: -.25em;
-	position: relative;
-	text-indent: -99999px;
-	overflow: hidden;
-	background-repeat: no-repeat;
-}
-
-.ui-widget-icon-block {
-	left: 50%;
-	margin-left: -8px;
-	display: block;
-}
-
-/* Misc visuals
-----------------------------------*/
-
-/* Overlays */
-.ui-widget-overlay {
-	position: fixed;
-	top: 0;
-	left: 0;
-	width: 100%;
-	height: 100%;
-}
-.ui-resizable {
-	position: relative;
-}
-.ui-resizable-handle {
-	position: absolute;
-	font-size: 0.1px;
-	display: block;
-	-ms-touch-action: none;
-	touch-action: none;
-}
-.ui-resizable-disabled .ui-resizable-handle,
-.ui-resizable-autohide .ui-resizable-handle {
-	display: none;
-}
-.ui-resizable-n {
-	cursor: n-resize;
-	height: 7px;
-	width: 100%;
-	top: -5px;
-	left: 0;
-}
-.ui-resizable-s {
-	cursor: s-resize;
-	height: 7px;
-	width: 100%;
-	bottom: -5px;
-	left: 0;
-}
-.ui-resizable-e {
-	cursor: e-resize;
-	width: 7px;
-	right: -5px;
-	top: 0;
-	height: 100%;
-}
-.ui-resizable-w {
-	cursor: w-resize;
-	width: 7px;
-	left: -5px;
-	top: 0;
-	height: 100%;
-}
-.ui-resizable-se {
-	cursor: se-resize;
-	width: 12px;
-	height: 12px;
-	right: 1px;
-	bottom: 1px;
-}
-.ui-resizable-sw {
-	cursor: sw-resize;
-	width: 9px;
-	height: 9px;
-	left: -5px;
-	bottom: -5px;
-}
-.ui-resizable-nw {
-	cursor: nw-resize;
-	width: 9px;
-	height: 9px;
-	left: -5px;
-	top: -5px;
-}
-.ui-resizable-ne {
-	cursor: ne-resize;
-	width: 9px;
-	height: 9px;
-	right: -5px;
-	top: -5px;
-}
-.ui-selectable {
-	-ms-touch-action: none;
-	touch-action: none;
-}
-.ui-selectable-helper {
-	position: absolute;
-	z-index: 100;
-	border: 1px dotted black;
-}
-.ui-sortable-handle {
-	-ms-touch-action: none;
-	touch-action: none;
-}
-.ui-accordion .ui-accordion-header {
-	display: block;
-	cursor: pointer;
-	position: relative;
-	margin: 2px 0 0 0;
-	padding: .5em .5em .5em .7em;
-	font-size: 100%;
-}
-.ui-accordion .ui-accordion-content {
-	padding: 1em 2.2em;
-	border-top: 0;
-	overflow: auto;
-}
-.ui-autocomplete {
-	position: absolute;
-	top: 0;
-	left: 0;
-	cursor: default;
-}
-.ui-menu {
-	list-style: none;
-	padding: 0;
-	margin: 0;
-	display: block;
-	outline: 0;
-}
-.ui-menu .ui-menu {
-	position: absolute;
-}
-.ui-menu .ui-menu-item {
-	margin: 0;
-	cursor: pointer;
-	/* support: IE10, see #8844 */
-	list-style-image: url("data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7");
-}
-.ui-menu .ui-menu-item-wrapper {
-	position: relative;
-	padding: 3px 1em 3px .4em;
-}
-.ui-menu .ui-menu-divider {
-	margin: 5px 0;
-	height: 0;
-	font-size: 0;
-	line-height: 0;
-	border-width: 1px 0 0 0;
-}
-.ui-menu .ui-state-focus,
-.ui-menu .ui-state-active {
-	margin: -1px;
-}
-
-/* icon support */
-.ui-menu-icons {
-	position: relative;
-}
-.ui-menu-icons .ui-menu-item-wrapper {
-	padding-left: 2em;
-}
-
-/* left-aligned */
-.ui-menu .ui-icon {
-	position: absolute;
-	top: 0;
-	bottom: 0;
-	left: .2em;
-	margin: auto 0;
-}
-
-/* right-aligned */
-.ui-menu .ui-menu-icon {
-	left: auto;
-	right: 0;
-}
-.ui-button {
-	padding: .4em 1em;
-	display: inline-block;
-	position: relative;
-	line-height: normal;
-	margin-right: .1em;
-	cursor: pointer;
-	vertical-align: middle;
-	text-align: center;
-	-webkit-user-select: none;
-	-moz-user-select: none;
-	-ms-user-select: none;
-	user-select: none;
-
-	/* Support: IE <= 11 */
-	overflow: visible;
-}
-
-.ui-button,
-.ui-button:link,
-.ui-button:visited,
-.ui-button:hover,
-.ui-button:active {
-	text-decoration: none;
-}
-
-/* to make room for the icon, a width needs to be set here */
-.ui-button-icon-only {
-	width: 2em;
-	box-sizing: border-box;
-	text-indent: -9999px;
-	white-space: nowrap;
-}
-
-/* no icon support for input elements */
-input.ui-button.ui-button-icon-only {
-	text-indent: 0;
-}
-
-/* button icon element(s) */
-.ui-button-icon-only .ui-icon {
-	position: absolute;
-	top: 50%;
-	left: 50%;
-	margin-top: -8px;
-	margin-left: -8px;
-}
-
-.ui-button.ui-icon-notext .ui-icon {
-	padding: 0;
-	width: 2.1em;
-	height: 2.1em;
-	text-indent: -9999px;
-	white-space: nowrap;
-
-}
-
-input.ui-button.ui-icon-notext .ui-icon {
-	width: auto;
-	height: auto;
-	text-indent: 0;
-	white-space: normal;
-	padding: .4em 1em;
-}
-
-/* workarounds */
-/* Support: Firefox 5 - 40 */
-input.ui-button::-moz-focus-inner,
-button.ui-button::-moz-focus-inner {
-	border: 0;
-	padding: 0;
-}
-.ui-controlgroup {
-	vertical-align: middle;
-	display: inline-block;
-}
-.ui-controlgroup > .ui-controlgroup-item {
-	float: left;
-	margin-left: 0;
-	margin-right: 0;
-}
-.ui-controlgroup > .ui-controlgroup-item:focus,
-.ui-controlgroup > .ui-controlgroup-item.ui-visual-focus {
-	z-index: 9999;
-}
-.ui-controlgroup-vertical > .ui-controlgroup-item {
-	display: block;
-	float: none;
-	width: 100%;
-	margin-top: 0;
-	margin-bottom: 0;
-	text-align: left;
-}
-.ui-controlgroup-vertical .ui-controlgroup-item {
-	box-sizing: border-box;
-}
-.ui-controlgroup .ui-controlgroup-label {
-	padding: .4em 1em;
-}
-.ui-controlgroup .ui-controlgroup-label span {
-	font-size: 80%;
-}
-.ui-controlgroup-horizontal .ui-controlgroup-label + .ui-controlgroup-item {
-	border-left: none;
-}
-.ui-controlgroup-vertical .ui-controlgroup-label + .ui-controlgroup-item {
-	border-top: none;
-}
-.ui-controlgroup-horizontal .ui-controlgroup-label.ui-widget-content {
-	border-right: none;
-}
-.ui-controlgroup-vertical .ui-controlgroup-label.ui-widget-content {
-	border-bottom: none;
-}
-
-/* Spinner specific style fixes */
-.ui-controlgroup-vertical .ui-spinner-input {
-
-	/* Support: IE8 only, Android < 4.4 only */
-	width: 75%;
-	width: calc( 100% - 2.4em );
-}
-.ui-controlgroup-vertical .ui-spinner .ui-spinner-up {
-	border-top-style: solid;
-}
-
-.ui-checkboxradio-label .ui-icon-background {
-	box-shadow: inset 1px 1px 1px #ccc;
-	border-radius: .12em;
-	border: none;
-}
-.ui-checkboxradio-radio-label .ui-icon-background {
-	width: 16px;
-	height: 16px;
-	border-radius: 1em;
-	overflow: visible;
-	border: none;
-}
-.ui-checkboxradio-radio-label.ui-checkboxradio-checked .ui-icon,
-.ui-checkboxradio-radio-label.ui-checkboxradio-checked:hover .ui-icon {
-	background-image: none;
-	width: 8px;
-	height: 8px;
-	border-width: 4px;
-	border-style: solid;
-}
-.ui-checkboxradio-disabled {
-	pointer-events: none;
-}
-.ui-datepicker {
-	width: 17em;
-	padding: .2em .2em 0;
-	display: none;
-}
-.ui-datepicker .ui-datepicker-header {
-	position: relative;
-	padding: .2em 0;
-}
-.ui-datepicker .ui-datepicker-prev,
-.ui-datepicker .ui-datepicker-next {
-	position: absolute;
-	top: 2px;
-	width: 1.8em;
-	height: 1.8em;
-}
-.ui-datepicker .ui-datepicker-prev-hover,
-.ui-datepicker .ui-datepicker-next-hover {
-	top: 1px;
-}
-.ui-datepicker .ui-datepicker-prev {
-	left: 2px;
-}
-.ui-datepicker .ui-datepicker-next {
-	right: 2px;
-}
-.ui-datepicker .ui-datepicker-prev-hover {
-	left: 1px;
-}
-.ui-datepicker .ui-datepicker-next-hover {
-	right: 1px;
-}
-.ui-datepicker .ui-datepicker-prev span,
-.ui-datepicker .ui-datepicker-next span {
-	display: block;
-	position: absolute;
-	left: 50%;
-	margin-left: -8px;
-	top: 50%;
-	margin-top: -8px;
-}
-.ui-datepicker .ui-datepicker-title {
-	margin: 0 2.3em;
-	line-height: 1.8em;
-	text-align: center;
-}
-.ui-datepicker .ui-datepicker-title select {
-	font-size: 1em;
-	margin: 1px 0;
-}
-.ui-datepicker select.ui-datepicker-month,
-.ui-datepicker select.ui-datepicker-year {
-	width: 45%;
-}
-.ui-datepicker table {
-	width: 100%;
-	font-size: .9em;
-	border-collapse: collapse;
-	margin: 0 0 .4em;
-}
-.ui-datepicker th {
-	padding: .7em .3em;
-	text-align: center;
-	font-weight: bold;
-	border: 0;
-}
-.ui-datepicker td {
-	border: 0;
-	padding: 1px;
-}
-.ui-datepicker td span,
-.ui-datepicker td a {
-	display: block;
-	padding: .2em;
-	text-align: right;
-	text-decoration: none;
-}
-.ui-datepicker .ui-datepicker-buttonpane {
-	background-image: none;
-	margin: .7em 0 0 0;
-	padding: 0 .2em;
-	border-left: 0;
-	border-right: 0;
-	border-bottom: 0;
-}
-.ui-datepicker .ui-datepicker-buttonpane button {
-	float: right;
-	margin: .5em .2em .4em;
-	cursor: pointer;
-	padding: .2em .6em .3em .6em;
-	width: auto;
-	overflow: visible;
-}
-.ui-datepicker .ui-datepicker-buttonpane button.ui-datepicker-current {
-	float: left;
-}
-
-/* with multiple calendars */
-.ui-datepicker.ui-datepicker-multi {
-	width: auto;
-}
-.ui-datepicker-multi .ui-datepicker-group {
-	float: left;
-}
-.ui-datepicker-multi .ui-datepicker-group table {
-	width: 95%;
-	margin: 0 auto .4em;
-}
-.ui-datepicker-multi-2 .ui-datepicker-group {
-	width: 50%;
-}
-.ui-datepicker-multi-3 .ui-datepicker-group {
-	width: 33.3%;
-}
-.ui-datepicker-multi-4 .ui-datepicker-group {
-	width: 25%;
-}
-.ui-datepicker-multi .ui-datepicker-group-last .ui-datepicker-header,
-.ui-datepicker-multi .ui-datepicker-group-middle .ui-datepicker-header {
-	border-left-width: 0;
-}
-.ui-datepicker-multi .ui-datepicker-buttonpane {
-	clear: left;
-}
-.ui-datepicker-row-break {
-	clear: both;
-	width: 100%;
-	font-size: 0;
-}
-
-/* RTL support */
-.ui-datepicker-rtl {
-	direction: rtl;
-}
-.ui-datepicker-rtl .ui-datepicker-prev {
-	right: 2px;
-	left: auto;
-}
-.ui-datepicker-rtl .ui-datepicker-next {
-	left: 2px;
-	right: auto;
-}
-.ui-datepicker-rtl .ui-datepicker-prev:hover {
-	right: 1px;
-	left: auto;
-}
-.ui-datepicker-rtl .ui-datepicker-next:hover {
-	left: 1px;
-	right: auto;
-}
-.ui-datepicker-rtl .ui-datepicker-buttonpane {
-	clear: right;
-}
-.ui-datepicker-rtl .ui-datepicker-buttonpane button {
-	float: left;
-}
-.ui-datepicker-rtl .ui-datepicker-buttonpane button.ui-datepicker-current,
-.ui-datepicker-rtl .ui-datepicker-group {
-	float: right;
-}
-.ui-datepicker-rtl .ui-datepicker-group-last .ui-datepicker-header,
-.ui-datepicker-rtl .ui-datepicker-group-middle .ui-datepicker-header {
-	border-right-width: 0;
-	border-left-width: 1px;
-}
-
-/* Icons */
-.ui-datepicker .ui-icon {
-	display: block;
-	text-indent: -99999px;
-	overflow: hidden;
-	background-repeat: no-repeat;
-	left: .5em;
-	top: .3em;
-}
-.ui-dialog {
-	position: absolute;
-	top: 0;
-	left: 0;
-	padding: .2em;
-	outline: 0;
-}
-.ui-dialog .ui-dialog-titlebar {
-	padding: .4em 1em;
-	position: relative;
-}
-.ui-dialog .ui-dialog-title {
-	float: left;
-	margin: .1em 0;
-	white-space: nowrap;
-	width: 90%;
-	overflow: hidden;
-	text-overflow: ellipsis;
-}
-.ui-dialog .ui-dialog-titlebar-close {
-	position: absolute;
-	right: .3em;
-	top: 50%;
-	width: 20px;
-	margin: -10px 0 0 0;
-	padding: 1px;
-	height: 20px;
-}
-.ui-dialog .ui-dialog-content {
-	position: relative;
-	border: 0;
-	padding: .5em 1em;
-	background: none;
-	overflow: auto;
-}
-.ui-dialog .ui-dialog-buttonpane {
-	text-align: left;
-	border-width: 1px 0 0 0;
-	background-image: none;
-	margin-top: .5em;
-	padding: .3em 1em .5em .4em;
-}
-.ui-dialog .ui-dialog-buttonpane .ui-dialog-buttonset {
-	float: right;
-}
-.ui-dialog .ui-dialog-buttonpane button {
-	margin: .5em .4em .5em 0;
-	cursor: pointer;
-}
-.ui-dialog .ui-resizable-n {
-	height: 2px;
-	top: 0;
-}
-.ui-dialog .ui-resizable-e {
-	width: 2px;
-	right: 0;
-}
-.ui-dialog .ui-resizable-s {
-	height: 2px;
-	bottom: 0;
-}
-.ui-dialog .ui-resizable-w {
-	width: 2px;
-	left: 0;
-}
-.ui-dialog .ui-resizable-se,
-.ui-dialog .ui-resizable-sw,
-.ui-dialog .ui-resizable-ne,
-.ui-dialog .ui-resizable-nw {
-	width: 7px;
-	height: 7px;
-}
-.ui-dialog .ui-resizable-se {
-	right: 0;
-	bottom: 0;
-}
-.ui-dialog .ui-resizable-sw {
-	left: 0;
-	bottom: 0;
-}
-.ui-dialog .ui-resizable-ne {
-	right: 0;
-	top: 0;
-}
-.ui-dialog .ui-resizable-nw {
-	left: 0;
-	top: 0;
-}
-.ui-draggable .ui-dialog-titlebar {
-	cursor: move;
-}
-.ui-progressbar {
-	height: 2em;
-	text-align: left;
-	overflow: hidden;
-}
-.ui-progressbar .ui-progressbar-value {
-	margin: -1px;
-	height: 100%;
-}
-.ui-progressbar .ui-progressbar-overlay {
-	background: url("data:image/gif;base64,R0lGODlhKAAoAIABAAAAAP///yH/C05FVFNDQVBFMi4wAwEAAAAh+QQJAQABACwAAAAAKAAoAAACkYwNqXrdC52DS06a7MFZI+4FHBCKoDeWKXqymPqGqxvJrXZbMx7Ttc+w9XgU2FB3lOyQRWET2IFGiU9m1frDVpxZZc6bfHwv4c1YXP6k1Vdy292Fb6UkuvFtXpvWSzA+HycXJHUXiGYIiMg2R6W459gnWGfHNdjIqDWVqemH2ekpObkpOlppWUqZiqr6edqqWQAAIfkECQEAAQAsAAAAACgAKAAAApSMgZnGfaqcg1E2uuzDmmHUBR8Qil95hiPKqWn3aqtLsS18y7G1SzNeowWBENtQd+T1JktP05nzPTdJZlR6vUxNWWjV+vUWhWNkWFwxl9VpZRedYcflIOLafaa28XdsH/ynlcc1uPVDZxQIR0K25+cICCmoqCe5mGhZOfeYSUh5yJcJyrkZWWpaR8doJ2o4NYq62lAAACH5BAkBAAEALAAAAAAoACgAAAKVDI4Yy22ZnINRNqosw0Bv7i1gyHUkFj7oSaWlu3ovC8GxNso5fluz3qLVhBVeT/Lz7ZTHyxL5dDalQWPVOsQWtRnuwXaFTj9jVVh8pma9JjZ4zYSj5ZOyma7uuolffh+IR5aW97cHuBUXKGKXlKjn+DiHWMcYJah4N0lYCMlJOXipGRr5qdgoSTrqWSq6WFl2ypoaUAAAIfkECQEAAQAsAAAAACgAKAAAApaEb6HLgd/iO7FNWtcFWe+ufODGjRfoiJ2akShbueb0wtI50zm02pbvwfWEMWBQ1zKGlLIhskiEPm9R6vRXxV4ZzWT2yHOGpWMyorblKlNp8HmHEb/lCXjcW7bmtXP8Xt229OVWR1fod2eWqNfHuMjXCPkIGNileOiImVmCOEmoSfn3yXlJWmoHGhqp6ilYuWYpmTqKUgAAIfkECQEAAQAsAAAAACgAKAAAApiEH6kb58biQ3FNWtMFWW3eNVcojuFGfqnZqSebuS06w5V80/X02pKe8zFwP6EFWOT1lDFk8rGERh1TTNOocQ61Hm4Xm2VexUHpzjymViHrFbiELsefVrn6XKfnt2Q9G/+Xdie499XHd2g4h7ioOGhXGJboGAnXSBnoBwKYyfioubZJ2Hn0RuRZaflZOil56Zp6iioKSXpUAAAh+QQJAQABACwAAAAAKAAoAAACkoQRqRvnxuI7kU1a1UU5bd5tnSeOZXhmn5lWK3qNTWvRdQxP8qvaC+/yaYQzXO7BMvaUEmJRd3TsiMAgswmNYrSgZdYrTX6tSHGZO73ezuAw2uxuQ+BbeZfMxsexY35+/Qe4J1inV0g4x3WHuMhIl2jXOKT2Q+VU5fgoSUI52VfZyfkJGkha6jmY+aaYdirq+lQAACH5BAkBAAEALAAAAAAoACgAAAKWBIKpYe0L3YNKToqswUlvznigd4wiR4KhZrKt9Upqip61i9E3vMvxRdHlbEFiEXfk9YARYxOZZD6VQ2pUunBmtRXo1Lf8hMVVcNl8JafV38aM2/Fu5V16Bn63r6xt97j09+MXSFi4BniGFae3hzbH9+hYBzkpuUh5aZmHuanZOZgIuvbGiNeomCnaxxap2upaCZsq+1kAACH5BAkBAAEALAAAAAAoACgAAAKXjI8By5zf4kOxTVrXNVlv1X0d8IGZGKLnNpYtm8Lr9cqVeuOSvfOW79D9aDHizNhDJidFZhNydEahOaDH6nomtJjp1tutKoNWkvA6JqfRVLHU/QUfau9l2x7G54d1fl995xcIGAdXqMfBNadoYrhH+Mg2KBlpVpbluCiXmMnZ2Sh4GBqJ+ckIOqqJ6LmKSllZmsoq6wpQAAAh+QQJAQABACwAAAAAKAAoAAAClYx/oLvoxuJDkU1a1YUZbJ59nSd2ZXhWqbRa2/gF8Gu2DY3iqs7yrq+xBYEkYvFSM8aSSObE+ZgRl1BHFZNr7pRCavZ5BW2142hY3AN/zWtsmf12p9XxxFl2lpLn1rseztfXZjdIWIf2s5dItwjYKBgo9yg5pHgzJXTEeGlZuenpyPmpGQoKOWkYmSpaSnqKileI2FAAACH5BAkBAAEALAAAAAAoACgAAAKVjB+gu+jG4kORTVrVhRlsnn2dJ3ZleFaptFrb+CXmO9OozeL5VfP99HvAWhpiUdcwkpBH3825AwYdU8xTqlLGhtCosArKMpvfa1mMRae9VvWZfeB2XfPkeLmm18lUcBj+p5dnN8jXZ3YIGEhYuOUn45aoCDkp16hl5IjYJvjWKcnoGQpqyPlpOhr3aElaqrq56Bq7VAAAOw==");
-	height: 100%;
-	filter: alpha(opacity=25); /* support: IE8 */
-	opacity: 0.25;
-}
-.ui-progressbar-indeterminate .ui-progressbar-value {
-	background-image: none;
-}
-.ui-selectmenu-menu {
-	padding: 0;
-	margin: 0;
-	position: absolute;
-	top: 0;
-	left: 0;
-	display: none;
-}
-.ui-selectmenu-menu .ui-menu {
-	overflow: auto;
-	overflow-x: hidden;
-	padding-bottom: 1px;
-}
-.ui-selectmenu-menu .ui-menu .ui-selectmenu-optgroup {
-	font-size: 1em;
-	font-weight: bold;
-	line-height: 1.5;
-	padding: 2px 0.4em;
-	margin: 0.5em 0 0 0;
-	height: auto;
-	border: 0;
-}
-.ui-selectmenu-open {
-	display: block;
-}
-.ui-selectmenu-text {
-	display: block;
-	margin-right: 20px;
-	overflow: hidden;
-	text-overflow: ellipsis;
-}
-.ui-selectmenu-button.ui-button {
-	text-align: left;
-	white-space: nowrap;
-	width: 14em;
-}
-.ui-selectmenu-icon.ui-icon {
-	float: right;
-	margin-top: 0;
-}
-.ui-slider {
-	position: relative;
-	text-align: left;
-}
-.ui-slider .ui-slider-handle {
-	position: absolute;
-	z-index: 2;
-	width: 1.2em;
-	height: 1.2em;
-	cursor: default;
-	-ms-touch-action: none;
-	touch-action: none;
-}
-.ui-slider .ui-slider-range {
-	position: absolute;
-	z-index: 1;
-	font-size: .7em;
-	display: block;
-	border: 0;
-	background-position: 0 0;
-}
-
-/* support: IE8 - See #6727 */
-.ui-slider.ui-state-disabled .ui-slider-handle,
-.ui-slider.ui-state-disabled .ui-slider-range {
-	filter: inherit;
-}
-
-.ui-slider-horizontal {
-	height: .8em;
-}
-.ui-slider-horizontal .ui-slider-handle {
-	top: -.3em;
-	margin-left: -.6em;
-}
-.ui-slider-horizontal .ui-slider-range {
-	top: 0;
-	height: 100%;
-}
-.ui-slider-horizontal .ui-slider-range-min {
-	left: 0;
-}
-.ui-slider-horizontal .ui-slider-range-max {
-	right: 0;
-}
-
-.ui-slider-vertical {
-	width: .8em;
-	height: 100px;
-}
-.ui-slider-vertical .ui-slider-handle {
-	left: -.3em;
-	margin-left: 0;
-	margin-bottom: -.6em;
-}
-.ui-slider-vertical .ui-slider-range {
-	left: 0;
-	width: 100%;
-}
-.ui-slider-vertical .ui-slider-range-min {
-	bottom: 0;
-}
-.ui-slider-vertical .ui-slider-range-max {
-	top: 0;
-}
-.ui-spinner {
-	position: relative;
-	display: inline-block;
-	overflow: hidden;
-	padding: 0;
-	vertical-align: middle;
-}
-.ui-spinner-input {
-	border: none;
-	background: none;
-	color: inherit;
-	padding: .222em 0;
-	margin: .2em 0;
-	vertical-align: middle;
-	margin-left: .4em;
-	margin-right: 2em;
-}
-.ui-spinner-button {
-	width: 1.6em;
-	height: 50%;
-	font-size: .5em;
-	padding: 0;
-	margin: 0;
-	text-align: center;
-	position: absolute;
-	cursor: default;
-	display: block;
-	overflow: hidden;
-	right: 0;
-}
-/* more specificity required here to override default borders */
-.ui-spinner a.ui-spinner-button {
-	border-top-style: none;
-	border-bottom-style: none;
-	border-right-style: none;
-}
-.ui-spinner-up {
-	top: 0;
-}
-.ui-spinner-down {
-	bottom: 0;
-}
-.ui-tabs {
-	position: relative;/* position: relative prevents IE scroll bug (element with position: relative inside container with overflow: auto appear as "fixed") */
-	padding: .2em;
-}
-.ui-tabs .ui-tabs-nav {
-	margin: 0;
-	padding: .2em .2em 0;
-}
-.ui-tabs .ui-tabs-nav li {
-	list-style: none;
-	float: left;
-	position: relative;
-	top: 0;
-	margin: 1px .2em 0 0;
-	border-bottom-width: 0;
-	padding: 0;
-	white-space: nowrap;
-}
-.ui-tabs .ui-tabs-nav .ui-tabs-anchor {
-	float: left;
-	padding: .5em 1em;
-	text-decoration: none;
-}
-.ui-tabs .ui-tabs-nav li.ui-tabs-active {
-	margin-bottom: -1px;
-	padding-bottom: 1px;
-}
-.ui-tabs .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor,
-.ui-tabs .ui-tabs-nav li.ui-state-disabled .ui-tabs-anchor,
-.ui-tabs .ui-tabs-nav li.ui-tabs-loading .ui-tabs-anchor {
-	cursor: text;
-}
-.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor {
-	cursor: pointer;
-}
-.ui-tabs .ui-tabs-panel {
-	display: block;
-	border-width: 0;
-	padding: 1em 1.4em;
-	background: none;
-}
-.ui-tooltip {
-	padding: 8px;
-	position: absolute;
-	z-index: 9999;
-	max-width: 300px;
-}
-body .ui-tooltip {
-	border-width: 2px;
-}

dist/escu/appserver/static/js/lib/jquery-ui/jquery-ui.theme.css

@@ -1,443 +0,0 @@
-/*!
- * jQuery UI CSS Framework 1.12.1
- * http://jqueryui.com
- *
- * Copyright jQuery Foundation and other contributors
- * Released under the MIT license.
- * http://jquery.org/license
- *
- * http://api.jqueryui.com/category/theming/
- *
- * To view and modify this theme, visit http://jqueryui.com/themeroller/?scope=&folderName=base&cornerRadiusShadow=8px&offsetLeftShadow=0px&offsetTopShadow=0px&thicknessShadow=5px&opacityShadow=30&bgImgOpacityShadow=0&bgTextureShadow=flat&bgColorShadow=666666&opacityOverlay=30&bgImgOpacityOverlay=0&bgTextureOverlay=flat&bgColorOverlay=aaaaaa&iconColorError=cc0000&fcError=5f3f3f&borderColorError=f1a899&bgTextureError=flat&bgColorError=fddfdf&iconColorHighlight=777620&fcHighlight=777620&borderColorHighlight=dad55e&bgTextureHighlight=flat&bgColorHighlight=fffa90&iconColorActive=ffffff&fcActive=ffffff&borderColorActive=003eff&bgTextureActive=flat&bgColorActive=007fff&iconColorHover=555555&fcHover=2b2b2b&borderColorHover=cccccc&bgTextureHover=flat&bgColorHover=ededed&iconColorDefault=777777&fcDefault=454545&borderColorDefault=c5c5c5&bgTextureDefault=flat&bgColorDefault=f6f6f6&iconColorContent=444444&fcContent=333333&borderColorContent=dddddd&bgTextureContent=flat&bgColorContent=ffffff&iconColorHeader=444444&fcHeader=333333&borderColorHeader=dddddd&bgTextureHeader=flat&bgColorHeader=e9e9e9&cornerRadius=3px&fwDefault=normal&fsDefault=1em&ffDefault=Arial%2CHelvetica%2Csans-serif
- */
-
-
-/* Component containers
-----------------------------------*/
-.ui-widget {
-	font-family: Arial,Helvetica,sans-serif;
-	font-size: 1em;
-}
-.ui-widget .ui-widget {
-	font-size: 1em;
-}
-.ui-widget input,
-.ui-widget select,
-.ui-widget textarea,
-.ui-widget button {
-	font-family: Arial,Helvetica,sans-serif;
-	font-size: 1em;
-}
-.ui-widget.ui-widget-content {
-	border: 1px solid #c5c5c5;
-}
-.ui-widget-content {
-	border: 1px solid #dddddd;
-	background: #ffffff;
-	color: #333333;
-}
-.ui-widget-content a {
-	color: #333333;
-}
-.ui-widget-header {
-	border: 1px solid #dddddd;
-	background: #e9e9e9;
-	color: #333333;
-	font-weight: bold;
-}
-.ui-widget-header a {
-	color: #333333;
-}
-
-/* Interaction states
-----------------------------------*/
-.ui-state-default,
-.ui-widget-content .ui-state-default,
-.ui-widget-header .ui-state-default,
-.ui-button,
-
-/* We use html here because we need a greater specificity to make sure disabled
-works properly when clicked or hovered */
-html .ui-button.ui-state-disabled:hover,
-html .ui-button.ui-state-disabled:active {
-	border: 1px solid #c5c5c5;
-	background: #f6f6f6;
-	font-weight: normal;
-	color: #454545;
-}
-.ui-state-default a,
-.ui-state-default a:link,
-.ui-state-default a:visited,
-a.ui-button,
-a:link.ui-button,
-a:visited.ui-button,
-.ui-button {
-	color: #454545;
-	text-decoration: none;
-}
-.ui-state-hover,
-.ui-widget-content .ui-state-hover,
-.ui-widget-header .ui-state-hover,
-.ui-state-focus,
-.ui-widget-content .ui-state-focus,
-.ui-widget-header .ui-state-focus,
-.ui-button:hover,
-.ui-button:focus {
-	border: 1px solid #cccccc;
-	background: #ededed;
-	font-weight: normal;
-	color: #2b2b2b;
-}
-.ui-state-hover a,
-.ui-state-hover a:hover,
-.ui-state-hover a:link,
-.ui-state-hover a:visited,
-.ui-state-focus a,
-.ui-state-focus a:hover,
-.ui-state-focus a:link,
-.ui-state-focus a:visited,
-a.ui-button:hover,
-a.ui-button:focus {
-	color: #2b2b2b;
-	text-decoration: none;
-}
-
-.ui-visual-focus {
-	box-shadow: 0 0 3px 1px rgb(94, 158, 214);
-}
-.ui-state-active,
-.ui-widget-content .ui-state-active,
-.ui-widget-header .ui-state-active,
-a.ui-button:active,
-.ui-button:active,
-.ui-button.ui-state-active:hover {
-	border: 1px solid #003eff;
-	background: #007fff;
-	font-weight: normal;
-	color: #ffffff;
-}
-.ui-icon-background,
-.ui-state-active .ui-icon-background {
-	border: #003eff;
-	background-color: #ffffff;
-}
-.ui-state-active a,
-.ui-state-active a:link,
-.ui-state-active a:visited {
-	color: #ffffff;
-	text-decoration: none;
-}
-
-/* Interaction Cues
-----------------------------------*/
-.ui-state-highlight,
-.ui-widget-content .ui-state-highlight,
-.ui-widget-header .ui-state-highlight {
-	border: 1px solid #dad55e;
-	background: #fffa90;
-	color: #777620;
-}
-.ui-state-checked {
-	border: 1px solid #dad55e;
-	background: #fffa90;
-}
-.ui-state-highlight a,
-.ui-widget-content .ui-state-highlight a,
-.ui-widget-header .ui-state-highlight a {
-	color: #777620;
-}
-.ui-state-error,
-.ui-widget-content .ui-state-error,
-.ui-widget-header .ui-state-error {
-	border: 1px solid #f1a899;
-	background: #fddfdf;
-	color: #5f3f3f;
-}
-.ui-state-error a,
-.ui-widget-content .ui-state-error a,
-.ui-widget-header .ui-state-error a {
-	color: #5f3f3f;
-}
-.ui-state-error-text,
-.ui-widget-content .ui-state-error-text,
-.ui-widget-header .ui-state-error-text {
-	color: #5f3f3f;
-}
-.ui-priority-primary,
-.ui-widget-content .ui-priority-primary,
-.ui-widget-header .ui-priority-primary {
-	font-weight: bold;
-}
-.ui-priority-secondary,
-.ui-widget-content .ui-priority-secondary,
-.ui-widget-header .ui-priority-secondary {
-	opacity: .7;
-	filter:Alpha(Opacity=70); /* support: IE8 */
-	font-weight: normal;
-}
-.ui-state-disabled,
-.ui-widget-content .ui-state-disabled,
-.ui-widget-header .ui-state-disabled {
-	opacity: .35;
-	filter:Alpha(Opacity=35); /* support: IE8 */
-	background-image: none;
-}
-.ui-state-disabled .ui-icon {
-	filter:Alpha(Opacity=35); /* support: IE8 - See #6059 */
-}
-
-/* Icons
-----------------------------------*/
-
-/* states and images */
-.ui-icon {
-	width: 16px;
-	height: 16px;
-}
-.ui-icon,
-.ui-widget-content .ui-icon {
-	background-image: url("images/ui-icons_444444_256x240.png");
-}
-.ui-widget-header .ui-icon {
-	background-image: url("images/ui-icons_444444_256x240.png");
-}
-.ui-state-hover .ui-icon,
-.ui-state-focus .ui-icon,
-.ui-button:hover .ui-icon,
-.ui-button:focus .ui-icon {
-	background-image: url("images/ui-icons_555555_256x240.png");
-}
-.ui-state-active .ui-icon,
-.ui-button:active .ui-icon {
-	background-image: url("images/ui-icons_ffffff_256x240.png");
-}
-.ui-state-highlight .ui-icon,
-.ui-button .ui-state-highlight.ui-icon {
-	background-image: url("images/ui-icons_777620_256x240.png");
-}
-.ui-state-error .ui-icon,
-.ui-state-error-text .ui-icon {
-	background-image: url("images/ui-icons_cc0000_256x240.png");
-}
-.ui-button .ui-icon {
-	background-image: url("images/ui-icons_777777_256x240.png");
-}
-
-/* positioning */
-.ui-icon-blank { background-position: 16px 16px; }
-.ui-icon-caret-1-n { background-position: 0 0; }
-.ui-icon-caret-1-ne { background-position: -16px 0; }
-.ui-icon-caret-1-e { background-position: -32px 0; }
-.ui-icon-caret-1-se { background-position: -48px 0; }
-.ui-icon-caret-1-s { background-position: -65px 0; }
-.ui-icon-caret-1-sw { background-position: -80px 0; }
-.ui-icon-caret-1-w { background-position: -96px 0; }
-.ui-icon-caret-1-nw { background-position: -112px 0; }
-.ui-icon-caret-2-n-s { background-position: -128px 0; }
-.ui-icon-caret-2-e-w { background-position: -144px 0; }
-.ui-icon-triangle-1-n { background-position: 0 -16px; }
-.ui-icon-triangle-1-ne { background-position: -16px -16px; }
-.ui-icon-triangle-1-e { background-position: -32px -16px; }
-.ui-icon-triangle-1-se { background-position: -48px -16px; }
-.ui-icon-triangle-1-s { background-position: -65px -16px; }
-.ui-icon-triangle-1-sw { background-position: -80px -16px; }
-.ui-icon-triangle-1-w { background-position: -96px -16px; }
-.ui-icon-triangle-1-nw { background-position: -112px -16px; }
-.ui-icon-triangle-2-n-s { background-position: -128px -16px; }
-.ui-icon-triangle-2-e-w { background-position: -144px -16px; }
-.ui-icon-arrow-1-n { background-position: 0 -32px; }
-.ui-icon-arrow-1-ne { background-position: -16px -32px; }
-.ui-icon-arrow-1-e { background-position: -32px -32px; }
-.ui-icon-arrow-1-se { background-position: -48px -32px; }
-.ui-icon-arrow-1-s { background-position: -65px -32px; }
-.ui-icon-arrow-1-sw { background-position: -80px -32px; }
-.ui-icon-arrow-1-w { background-position: -96px -32px; }
-.ui-icon-arrow-1-nw { background-position: -112px -32px; }
-.ui-icon-arrow-2-n-s { background-position: -128px -32px; }
-.ui-icon-arrow-2-ne-sw { background-position: -144px -32px; }
-.ui-icon-arrow-2-e-w { background-position: -160px -32px; }
-.ui-icon-arrow-2-se-nw { background-position: -176px -32px; }
-.ui-icon-arrowstop-1-n { background-position: -192px -32px; }
-.ui-icon-arrowstop-1-e { background-position: -208px -32px; }
-.ui-icon-arrowstop-1-s { background-position: -224px -32px; }
-.ui-icon-arrowstop-1-w { background-position: -240px -32px; }
-.ui-icon-arrowthick-1-n { background-position: 1px -48px; }
-.ui-icon-arrowthick-1-ne { background-position: -16px -48px; }
-.ui-icon-arrowthick-1-e { background-position: -32px -48px; }
-.ui-icon-arrowthick-1-se { background-position: -48px -48px; }
-.ui-icon-arrowthick-1-s { background-position: -64px -48px; }
-.ui-icon-arrowthick-1-sw { background-position: -80px -48px; }
-.ui-icon-arrowthick-1-w { background-position: -96px -48px; }
-.ui-icon-arrowthick-1-nw { background-position: -112px -48px; }
-.ui-icon-arrowthick-2-n-s { background-position: -128px -48px; }
-.ui-icon-arrowthick-2-ne-sw { background-position: -144px -48px; }
-.ui-icon-arrowthick-2-e-w { background-position: -160px -48px; }
-.ui-icon-arrowthick-2-se-nw { background-position: -176px -48px; }
-.ui-icon-arrowthickstop-1-n { background-position: -192px -48px; }
-.ui-icon-arrowthickstop-1-e { background-position: -208px -48px; }
-.ui-icon-arrowthickstop-1-s { background-position: -224px -48px; }
-.ui-icon-arrowthickstop-1-w { background-position: -240px -48px; }
-.ui-icon-arrowreturnthick-1-w { background-position: 0 -64px; }
-.ui-icon-arrowreturnthick-1-n { background-position: -16px -64px; }
-.ui-icon-arrowreturnthick-1-e { background-position: -32px -64px; }
-.ui-icon-arrowreturnthick-1-s { background-position: -48px -64px; }
-.ui-icon-arrowreturn-1-w { background-position: -64px -64px; }
-.ui-icon-arrowreturn-1-n { background-position: -80px -64px; }
-.ui-icon-arrowreturn-1-e { background-position: -96px -64px; }
-.ui-icon-arrowreturn-1-s { background-position: -112px -64px; }
-.ui-icon-arrowrefresh-1-w { background-position: -128px -64px; }
-.ui-icon-arrowrefresh-1-n { background-position: -144px -64px; }
-.ui-icon-arrowrefresh-1-e { background-position: -160px -64px; }
-.ui-icon-arrowrefresh-1-s { background-position: -176px -64px; }
-.ui-icon-arrow-4 { background-position: 0 -80px; }
-.ui-icon-arrow-4-diag { background-position: -16px -80px; }
-.ui-icon-extlink { background-position: -32px -80px; }
-.ui-icon-newwin { background-position: -48px -80px; }
-.ui-icon-refresh { background-position: -64px -80px; }
-.ui-icon-shuffle { background-position: -80px -80px; }
-.ui-icon-transfer-e-w { background-position: -96px -80px; }
-.ui-icon-transferthick-e-w { background-position: -112px -80px; }
-.ui-icon-folder-collapsed { background-position: 0 -96px; }
-.ui-icon-folder-open { background-position: -16px -96px; }
-.ui-icon-document { background-position: -32px -96px; }
-.ui-icon-document-b { background-position: -48px -96px; }
-.ui-icon-note { background-position: -64px -96px; }
-.ui-icon-mail-closed { background-position: -80px -96px; }
-.ui-icon-mail-open { background-position: -96px -96px; }
-.ui-icon-suitcase { background-position: -112px -96px; }
-.ui-icon-comment { background-position: -128px -96px; }
-.ui-icon-person { background-position: -144px -96px; }
-.ui-icon-print { background-position: -160px -96px; }
-.ui-icon-trash { background-position: -176px -96px; }
-.ui-icon-locked { background-position: -192px -96px; }
-.ui-icon-unlocked { background-position: -208px -96px; }
-.ui-icon-bookmark { background-position: -224px -96px; }
-.ui-icon-tag { background-position: -240px -96px; }
-.ui-icon-home { background-position: 0 -112px; }
-.ui-icon-flag { background-position: -16px -112px; }
-.ui-icon-calendar { background-position: -32px -112px; }
-.ui-icon-cart { background-position: -48px -112px; }
-.ui-icon-pencil { background-position: -64px -112px; }
-.ui-icon-clock { background-position: -80px -112px; }
-.ui-icon-disk { background-position: -96px -112px; }
-.ui-icon-calculator { background-position: -112px -112px; }
-.ui-icon-zoomin { background-position: -128px -112px; }
-.ui-icon-zoomout { background-position: -144px -112px; }
-.ui-icon-search { background-position: -160px -112px; }
-.ui-icon-wrench { background-position: -176px -112px; }
-.ui-icon-gear { background-position: -192px -112px; }
-.ui-icon-heart { background-position: -208px -112px; }
-.ui-icon-star { background-position: -224px -112px; }
-.ui-icon-link { background-position: -240px -112px; }
-.ui-icon-cancel { background-position: 0 -128px; }
-.ui-icon-plus { background-position: -16px -128px; }
-.ui-icon-plusthick { background-position: -32px -128px; }
-.ui-icon-minus { background-position: -48px -128px; }
-.ui-icon-minusthick { background-position: -64px -128px; }
-.ui-icon-close { background-position: -80px -128px; }
-.ui-icon-closethick { background-position: -96px -128px; }
-.ui-icon-key { background-position: -112px -128px; }
-.ui-icon-lightbulb { background-position: -128px -128px; }
-.ui-icon-scissors { background-position: -144px -128px; }
-.ui-icon-clipboard { background-position: -160px -128px; }
-.ui-icon-copy { background-position: -176px -128px; }
-.ui-icon-contact { background-position: -192px -128px; }
-.ui-icon-image { background-position: -208px -128px; }
-.ui-icon-video { background-position: -224px -128px; }
-.ui-icon-script { background-position: -240px -128px; }
-.ui-icon-alert { background-position: 0 -144px; }
-.ui-icon-info { background-position: -16px -144px; }
-.ui-icon-notice { background-position: -32px -144px; }
-.ui-icon-help { background-position: -48px -144px; }
-.ui-icon-check { background-position: -64px -144px; }
-.ui-icon-bullet { background-position: -80px -144px; }
-.ui-icon-radio-on { background-position: -96px -144px; }
-.ui-icon-radio-off { background-position: -112px -144px; }
-.ui-icon-pin-w { background-position: -128px -144px; }
-.ui-icon-pin-s { background-position: -144px -144px; }
-.ui-icon-play { background-position: 0 -160px; }
-.ui-icon-pause { background-position: -16px -160px; }
-.ui-icon-seek-next { background-position: -32px -160px; }
-.ui-icon-seek-prev { background-position: -48px -160px; }
-.ui-icon-seek-end { background-position: -64px -160px; }
-.ui-icon-seek-start { background-position: -80px -160px; }
-/* ui-icon-seek-first is deprecated, use ui-icon-seek-start instead */
-.ui-icon-seek-first { background-position: -80px -160px; }
-.ui-icon-stop { background-position: -96px -160px; }
-.ui-icon-eject { background-position: -112px -160px; }
-.ui-icon-volume-off { background-position: -128px -160px; }
-.ui-icon-volume-on { background-position: -144px -160px; }
-.ui-icon-power { background-position: 0 -176px; }
-.ui-icon-signal-diag { background-position: -16px -176px; }
-.ui-icon-signal { background-position: -32px -176px; }
-.ui-icon-battery-0 { background-position: -48px -176px; }
-.ui-icon-battery-1 { background-position: -64px -176px; }
-.ui-icon-battery-2 { background-position: -80px -176px; }
-.ui-icon-battery-3 { background-position: -96px -176px; }
-.ui-icon-circle-plus { background-position: 0 -192px; }
-.ui-icon-circle-minus { background-position: -16px -192px; }
-.ui-icon-circle-close { background-position: -32px -192px; }
-.ui-icon-circle-triangle-e { background-position: -48px -192px; }
-.ui-icon-circle-triangle-s { background-position: -64px -192px; }
-.ui-icon-circle-triangle-w { background-position: -80px -192px; }
-.ui-icon-circle-triangle-n { background-position: -96px -192px; }
-.ui-icon-circle-arrow-e { background-position: -112px -192px; }
-.ui-icon-circle-arrow-s { background-position: -128px -192px; }
-.ui-icon-circle-arrow-w { background-position: -144px -192px; }
-.ui-icon-circle-arrow-n { background-position: -160px -192px; }
-.ui-icon-circle-zoomin { background-position: -176px -192px; }
-.ui-icon-circle-zoomout { background-position: -192px -192px; }
-.ui-icon-circle-check { background-position: -208px -192px; }
-.ui-icon-circlesmall-plus { background-position: 0 -208px; }
-.ui-icon-circlesmall-minus { background-position: -16px -208px; }
-.ui-icon-circlesmall-close { background-position: -32px -208px; }
-.ui-icon-squaresmall-plus { background-position: -48px -208px; }
-.ui-icon-squaresmall-minus { background-position: -64px -208px; }
-.ui-icon-squaresmall-close { background-position: -80px -208px; }
-.ui-icon-grip-dotted-vertical { background-position: 0 -224px; }
-.ui-icon-grip-dotted-horizontal { background-position: -16px -224px; }
-.ui-icon-grip-solid-vertical { background-position: -32px -224px; }
-.ui-icon-grip-solid-horizontal { background-position: -48px -224px; }
-.ui-icon-gripsmall-diagonal-se { background-position: -64px -224px; }
-.ui-icon-grip-diagonal-se { background-position: -80px -224px; }
-
-
-/* Misc visuals
-----------------------------------*/
-
-/* Corner radius */
-.ui-corner-all,
-.ui-corner-top,
-.ui-corner-left,
-.ui-corner-tl {
-	border-top-left-radius: 3px;
-}
-.ui-corner-all,
-.ui-corner-top,
-.ui-corner-right,
-.ui-corner-tr {
-	border-top-right-radius: 3px;
-}
-.ui-corner-all,
-.ui-corner-bottom,
-.ui-corner-left,
-.ui-corner-bl {
-	border-bottom-left-radius: 3px;
-}
-.ui-corner-all,
-.ui-corner-bottom,
-.ui-corner-right,
-.ui-corner-br {
-	border-bottom-right-radius: 3px;
-}
-
-/* Overlays */
-.ui-widget-overlay {
-	background: #aaaaaa;
-	opacity: .3;
-	filter: Alpha(Opacity=30); /* support: IE8 */
-}
-.ui-widget-shadow {
-	-webkit-box-shadow: 0px 0px 5px #666666;
-	box-shadow: 0px 0px 5px #666666;
-}

dist/escu/appserver/static/js/lib/jquery-ui/package.json

@@ -1,74 +0,0 @@
-{
-  "author": {
-    "name": "jQuery Foundation and other contributors",
-    "url": "https://github.com/jquery/jquery-ui/blob/1.12.1/AUTHORS.txt"
-  },
-  "bugs": "https://bugs.jqueryui.com/",
-  "dependencies": {},
-  "description": "A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library.",
-  "devDependencies": {
-    "commitplease": "2.3.0",
-    "grunt": "0.4.5",
-    "grunt-bowercopy": "1.2.4",
-    "grunt-cli": "0.1.13",
-    "grunt-compare-size": "0.4.0",
-    "grunt-contrib-concat": "0.5.1",
-    "grunt-contrib-csslint": "0.5.0",
-    "grunt-contrib-jshint": "0.12.0",
-    "grunt-contrib-qunit": "1.0.1",
-    "grunt-contrib-requirejs": "0.4.4",
-    "grunt-contrib-uglify": "0.11.1",
-    "grunt-git-authors": "3.1.0",
-    "grunt-html": "6.0.0",
-    "grunt-jscs": "2.1.0",
-    "load-grunt-tasks": "3.4.0",
-    "rimraf": "2.5.1",
-    "testswarm": "1.1.0"
-  },
-  "homepage": "http://jqueryui.com",
-  "keywords": [],
-  "license": "MIT",
-  "main": "ui/widget.js",
-  "maintainers": [
-    {
-      "email": "scott.gonzalez@gmail.com",
-      "name": "Scott Gonz\u00e1lez",
-      "url": "http://scottgonzalez.com"
-    },
-    {
-      "email": "joern.zaefferer@gmail.com",
-      "name": "J\u00f6rn Zaefferer",
-      "url": "http://bassistance.de"
-    },
-    {
-      "email": "mike.sherov@gmail.com",
-      "name": "Mike Sherov",
-      "url": "http://mike.sherov.com"
-    },
-    {
-      "email": "tj.vantoll@gmail.com",
-      "name": "TJ VanToll",
-      "url": "http://tjvantoll.com"
-    },
-    {
-      "email": "info@felixnagel.com",
-      "name": "Felix Nagel",
-      "url": "http://www.felixnagel.com"
-    },
-    {
-      "email": "arschmitz@gmail.com",
-      "name": "Alex Schmitz",
-      "url": "https://github.com/arschmitz"
-    }
-  ],
-  "name": "jquery-ui",
-  "repository": {
-    "type": "git",
-    "url": "git://github.com/jquery/jquery-ui.git"
-  },
-  "scripts": {
-    "test": "grunt"
-  },
-  "title": "jQuery UI",
-  "version": "1.12.1"
-}

dist/escu/appserver/static/js/lib/tabs.css

@@ -1,19 +0,0 @@
-#tabs {
-    border-bottom: 0px;
-}
-
-#tabs>.dashboard-cell>.dashboard-panel {
-    margin-bottom: 0px;
-    border-bottom: 0px;
-}
-
-#element1>.html {
-    padding-left: 0px;
-    /* This fixes some weirdness where the first tab doesn't look right due to the left part of the tab showing */
-    padding-right: 0px;
-    padding-top: 0px;
-}
-
-#tab_1>.dashboard-cell>.dashboard-panel {
-    border-top: 0px;
-}

dist/escu/appserver/static/js/lib/tabs.js

@@ -1,240 +0,0 @@
-require(['jquery','underscore','splunkjs/mvc', 'bootstrap.tab', 'splunkjs/mvc/simplexml/ready!'],
-		function($, _, mvc){
-	
-	var tabsInitialzed = [];
-	
-	/**
-	 * The below defines the tab handling logic.
-	 */
-	
-	/**
-	 * This hides the content associated with the tabs.
-	 *
-	 * The normal, auto-magical Bootstrap tab processing doesn't work for us since it requires a particular
-	 * layout of HTML that we cannot use without converting the view entirely to simpleXML. So, we are
-	 * going to handle it ourselves.
-	 * @param {string} tabSetClass the 
-	 */
-	var hideTabTargets = function(tabSetClass) {
-
-		var tabs = $('a[data-elements]');
-
-		// If we are only applying this to a particular set of tabs, then limit the selector accordingly
-		if (typeof tabSetClass !== 'undefined' && tabSetClass) {
-			tabs = $('a.' + tabSetClass + '[data-elements]');
-		}
-
-		// Go through each toggle tab
-		for (var c = 0; c < tabs.length; c++) {
-
-			// Hide the targets associated with the tab
-			var targets = $(tabs[c]).data("elements").split(",");
-
-			for (var d = 0; d < targets.length; d++) {
-				$('#' + targets[d], this.$el).hide();
-			}
-		}
-	};
-	
-	/**
-	 * Force a re-render of the panels with the given row ID.
-	 *
-	 * @param {string} row_id The ID of the row to force a rerender on
-	 * @param {bool} force Force the tab to re-render even if it was already rendered once (defaults to true)
-	 */
-	var rerenderPanels = function(row_id, force){
-		
-		// Set a default argument for dont_rerender_until_needed
-    	if( typeof force === 'undefined'){
-    		force = true;
-    	}
-		
-		// Don't do both if the panel was already rendered
-		if( !force && _.contains(tabsInitialzed, row_id) ){
-			return;
-		}
-		
-		// Get the elements so that we can find the components to re-render
-		var elements = $('#' + row_id + ' .dashboard-element');
-		
-		// Iterate the list and re-render the components so that they fill the screen
-		for(var d = 0; d < elements.length; d++){
-			
-			// Determine if this is re-sizable
-			if( $('#' + row_id + ' .ui-resizable').length > 0){
-			
-				var component = mvc.Components.get(elements[d].id);
-				
-				if(component){
-					component.render();
-				}
-			}
-		}
-		
-		// Remember that we initialized this tab
-		tabsInitialzed.push(row_id);
-	};
-	
-	/**
-	 * Handles the selection of a partiular tab.
-	 *
-	 * @param {*} e 
-	 */
-	var selectTab = function (e) {
-		// Update which tab is considered active
-		$('#tabs > li.active').removeClass("active");
-		$(e.target).closest("li").addClass("active");
-
-		// clearTabControlTokens();
-		setActiveTabToken();
-
-		// Stop if the tabs have no elements
-		if( $(e.target).data("elements") === undefined ){
-			console.warn("Yikes, the clicked tab has no elements to hide!");
-			return;
-		}
-		
-		// Determine if the set of tabs has a restriction on the classes to manipulate
-		var tabSet = null;
-
-		if ($(e.target).data("tab-set") !== undefined) {
-			tabSet = $(e.target).data("tab-set");
-		}
-
-		// Get the IDs that we should enable for this tab
-		var toToggle = $(e.target).data("elements").split(",");
-		
-		// Hide the tab content by default
-		hideTabTargets(tabSet);
-		
-		// Now show this tabs toggle elements
-		for(var c = 0; c < toToggle.length; c++){
-			
-			// Show the items
-			$('#' + toToggle[c], this.$el).show();
-			
-			// Re-render the panels under the item if necessary
-			rerenderPanels(toToggle[c]);
-		}
-		
-	};
-    
-    /**
-     * The code below handles the tokens that trigger when searches are kicked off for a tab.
-     */
-    
-	/**
-	 * Get the tab token for a given tab name
-	 * @param {string} tab_name The name of the tab
-	 */
-    var getTabTokenForTabName = function(tab_name){
-    	return tab_name;
-    };
-    
-    // Get all of the possible tab control tokens
-    var getTabTokens = function(){
-    	var tabTokens = [];
-    	
-    	var tabLinks = $('#tabs > li > a');
-    	
-    	for(var c = 0; c < tabLinks.length; c++){
-    		tabTokens.push( getTabTokenForTabName( $(tabLinks[c]).data('token') ) );
-    	}
-    	
-    	return tabTokens;
-    };
-
-	/**
-	 * Clear all but the active tab control tokens
-	 */
-    var clearTabControlTokens = function(){
-    	console.info("Clearing tab control tokens");
-    	
-    	//tabsInitialzed = [];
-    	var tabTokens = getTabTokens();
-    	var activeTabToken = getActiveTabToken();
-    	var tokens = mvc.Components.getInstance("submitted");
-    	
-    	// Clear the tokens for all tabs except for the active one
-    	for(var c = 0; c < tabTokens.length; c++){
-    		
-    		if( activeTabToken !== tabTokens[c] ){
-    			tokens.set(tabTokens[c], undefined);
-    		}
-    	}
-    };
-    
-	/**
-	 * Get the tab control token for the active tab
-	 */
-    var getActiveTabToken = function(){
-    	return $('#tabs > li.active > a').data('token');
-    };
-    
-	/**
-	 * Set the token for the active tab
-	 */
-    var setActiveTabToken = function(){
-		var activeTabToken = getActiveTabToken();
-		var tokens = mvc.Components.getInstance("submitted");
-		
-		if(activeTabToken){
-			// Set each token if necessary
-			activeTabToken.split(",").forEach(function(token){
-
-				// If the token wasn't set, set it so that the searches can run
-				if(!tokens.toJSON()[token] || tokens.toJSON()[token] == undefined){
-					tokens.set(token, "");
-				}
-			});
-		}
-    };
-	
-	/**
-	 * Handle the setting of the token for the clicked tab.
-	 * @param {*} e 
-	 */
-    var setTokenForTab = function(e){
-    	
-		// Get the token for the tab
-    	var tabToken = getTabTokenForTabName($(e.target).data('token'));
-		
-		// Set the token
-		var tokens = mvc.Components.getInstance("submitted");
-		tokens.set(tabToken, '');
-		
-		console.info("Set the token for the active tab (" + tabToken + ")");
-    };
-	
-	/**
-	 * Perform the initial setup for making the tabs work.
-	 */
-	var firstTimeTabSetup = function() { 
-		$('a.toggle-tab').on('shown', setTokenForTab);
-		
-		// Wire up the function to show the appropriate tab
-		$('a.toggle-tab').on('click shown', selectTab);
-		
-		// Show the first tab in each tab set
-		$.each($('.nav-tabs'), function(index, value) {
-			$('.toggle-tab', value).first().trigger('shown');
-		});
-		
-		// Make the tabs into tabs
-		$('#tabs', this.$el).tab();
-		
-		// Wire up the tab control tokenization
-		var submit = mvc.Components.get("submit");
-		
-		if(submit){
-			submit.on("submit", function() {
-				clearTabControlTokens();
-			});
-		}
-		
-		// Set the token for the selected tab
-		setActiveTabToken();
-	};
-
-	firstTimeTabSetup();
-});

dist/escu/default/analytic_stories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:46:44 UTC
+# On Date: 2021-05-24T20:38:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -316,8 +316,8 @@ modification_date = 2021-02-16
 id = bcfd17e8-5461-400a-80a2-3b7d1459220c
 version = 1
 reference = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"]
-detection_searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"]
-mappings = {"cis20": ["CIS 16", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exploitation"], "mitre_attack": ["T1036.003", "T1055", "T1127", "T1127.001", "T1218.010", "T1218.011", "T1560.001"], "nist": ["DE.CM", "PR.PT"]}
+detection_searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"]
+mappings = {"cis20": ["CIS 16", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1036.003", "T1055", "T1127", "T1127.001", "T1218.010", "T1218.011", "T1548", "T1560.001"], "nist": ["DE.CM", "PR.PT"]}
 investigative_searches = []
 support_searches = []
 data_models = ["Endpoint"]
@@ -510,8 +510,8 @@ product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
 
 [DarkSide Ransomware]
 category =  Malware
-creation_date = 2020-06-12
-modification_date = 2020-06-12
+creation_date = 2021-05-12
+modification_date = 2021-05-12
 id = 507edc74-13d5-4339-878e-b9114ded1f35
 version = 1
 reference = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"]
@@ -532,8 +532,8 @@ modification_date = 2020-10-21
 id = 66b0fe0c-1351-11eb-adc1-0242ac120002
 version = 1
 reference = ["https://attack.mitre.org/tactics/TA0010/"]
-detection_searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule"]
-mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1041"], "nist": ["DE.AE", "DE.CM", "PR.DS"]}
+detection_searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"]
+mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives"], "mitre_attack": ["T1041", "T1114", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
 data_models = []
@@ -1764,8 +1764,8 @@ modification_date = 2020-02-04
 id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6
 version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
-detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
-mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1016", "T1036.003", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
+detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"]
+mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1016", "T1036.003", "T1190", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK"]
 data_models = ["Endpoint"]
@@ -1939,4 +1939,21 @@ description = Windows services are often used by attackers for persistence and t
 narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection.
 product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
 
+[XMRig]
+category =  Malware
+creation_date = 2021-05-07
+modification_date = 2021-05-07
+id = 06723e6a-6bd8-4817-ace2-5fb8a7b06628
+version = 1
+reference = ["https://github.com/xmrig/xmrig", "https://www.getmonero.org/resources/user-guides/mine-to-pool.html", "https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"]
+detection_searches = ["ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"]
+mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1053", "T1087", "T1105", "T1222", "T1489", "T1531", "T1543", "T1543.003", "T1562.001"]}
+investigative_searches = []
+support_searches = []
+data_models = ["Endpoint"]
+providing_technologies = none
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.
+narrative = XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. This monero is seen in the wild on May 2017.
+product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
+
 #### END STORIES ####

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:46:44 UTC
+# On Date: 2021-05-24T20:38:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -220,7 +220,7 @@ version = 1
 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"]
+searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"]
 description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility.
 narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\
 Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\
@@ -354,7 +354,7 @@ The searches in this Analytic Story help you detect and investigate activities t
 
 [analytic_story://DarkSide Ransomware]
 category = Malware
-last_updated = 2020-06-12
+last_updated = 2021-05-12
 version = 1
 references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
@@ -370,7 +370,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0010/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Get Notable History - Response Task"]
 description = The stealing of data by an adversary.
 narrative = Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command and Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.
 
@@ -1218,7 +1218,7 @@ version = 2
 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\
 This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\
@@ -1333,6 +1333,17 @@ searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg
 description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection.
 
+[analytic_story://XMRig]
+category = Malware
+last_updated = 2021-05-07
+version = 1
+references = ["https://github.com/xmrig/xmrig", "https://www.getmonero.org/resources/user-guides/mine-to-pool.html", "https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"]
+maintainers = [{"company": "Rod Soto Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.
+narrative = XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. This monero is seen in the wild on May 2017.
+
 ### END STORIES ###
 
 ### DETECTIONS ###
@@ -2217,6 +2228,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Deleting Of Net Users - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
+known_false_positives = System administrators or scripts may delete user accounts via this technique. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Deleting Shadow Copies - Rule]
 type = detection
 asset_type = Endpoint
@@ -3112,6 +3133,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.00
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Disable Windows App Hotkeys - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems.
+how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Disable Windows Behavior Monitoring - Rule]
 type = detection
 asset_type = 
@@ -3172,6 +3203,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = admin may disable this application for non technical user.
 providing_technologies = []
 
+[savedsearch://ESCU - Disabling Net User Account - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Disabling NoRun Windows App - Rule]
 type = detection
 asset_type = 
@@ -3212,6 +3253,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = admin may disable this application for non technical user.
 providing_technologies = []
 
+[savedsearch://ESCU - Download Files Using Telegram - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
+known_false_positives = normal download of file in telegram app. (if it was a common app in network)
+providing_technologies = []
+
 [savedsearch://ESCU - Dump LSASS via comsvcs DLL - Rule]
 type = detection
 asset_type = Endpoint
@@ -3326,6 +3377,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
 providing_technologies = []
 
+[savedsearch://ESCU - Enumerate Users Local Group Using Telegram - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Eventvwr UAC Bypass - Rule]
 type = detection
 asset_type = 
@@ -3356,6 +3417,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.00
 known_false_positives = False positives should be limited, but if any are present, filter as needed. In some instances, `cscript.exe` is used for legitimate business practices.
 providing_technologies = []
 
+[savedsearch://ESCU - Excessive Attempt To Disable Services - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Excessive DNS Failures - Rule]
 type = detection
 asset_type = Endpoint
@@ -3366,6 +3437,46 @@ annotations = {"cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Com
 known_false_positives = It is possible legitimate traffic can trigger this rule. Please investigate as appropriate. The threshold for generating an event can also be customized to better suit your environment.
 providing_technologies = []
 
+[savedsearch://ESCU - Excessive Service Stop Attempt - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - Excessive Usage Of Cacls App - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application to change file or folder permission. This behavior is commonly seen where the adversary attempts to impair some users from deleting or accessing its malware components or artifact from the compromised system.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = Administrators or administrative scripts may use this application. Filter as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Excessive Usage Of Net App - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies excessive usage of `net.exe` or `net1.exe` within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its malicious behavior.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
+known_false_positives = unknown. Filter as needed. Modify the time span as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Excessive Usage Of Taskkill - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = Unknown. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Excessive Usage of NSLOOKUP App - Rule]
 type = detection
 asset_type = 
@@ -3376,6 +3487,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]}
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Executables Or Script Creation In Suspicious Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"]}
+known_false_positives = Administrators may allow creation of script or exe in the paths specified. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Execution of File With Spaces Before Extension - Rule]
 type = detection
 asset_type = Endpoint
@@ -3540,6 +3661,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
 providing_technologies = []
 
+[savedsearch://ESCU - Hide User Account From Sign-In Screen - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine.
+how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = Unknown. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Hiding Files And Directories With Attrib exe - Rule]
 type = detection
 asset_type = 
@@ -3590,6 +3721,26 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
 providing_technologies = []
 
+[savedsearch://ESCU - ICACLS Grant Command - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component files.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = Unknown. Filter as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Icacls Deny Command - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = Unknown. It is possible some administrative scripts use ICacls. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Identify New User Accounts - Rule]
 type = detection
 asset_type = Domain Server
@@ -3880,6 +4031,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["
 known_false_positives = Creating a hidden powershell service is rare and could key off of those instances.
 providing_technologies = []
 
+[savedsearch://ESCU - Modify ACL permission To Files Or Folder - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = administrators may use this command. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Monitor DNS For Brand Abuse - Rule]
 type = detection
 asset_type = Endpoint
@@ -4416,6 +4577,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = Although unlikely, administrators may use wmi to execute commands for legitimate purposes.
 providing_technologies = []
 
+[savedsearch://ESCU - Process Kill Base On File Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed wmic.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = Unknown.
+providing_technologies = []
+
 [savedsearch://ESCU - Processes Tapping Keyboard Events - Rule]
 type = detection
 asset_type = Endpoint
@@ -4743,7 +4914,7 @@ providing_technologies = []
 type = detection
 asset_type = 
 confidence = medium
-explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
+explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]}
 known_false_positives = unknown
@@ -4769,6 +4940,16 @@ annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = No known false positives
 providing_technologies = []
 
+[savedsearch://ESCU - Schtasks Run Task On Demand - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies an on demand run of a Windows Schedule Task through shell or command-line. This technique has been used by adversaries that force to run their created Schedule Task as their persistence mechanism or for lateral movement as part of their malicious attack to the compromised machine.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]}
+known_false_positives = Administrators may use to debug Schedule Task entries. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Schtasks scheduling job on remote system - Rule]
 type = detection
 asset_type = Endpoint
@@ -4809,6 +4990,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
 providing_technologies = []
 
+[savedsearch://ESCU - Services Escalate Exe - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the use of `svc-exe` with Cobalt Strike. The behavior typically follows after an adversary has already gained initial access and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following, the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\` with multiple keys and values added to look like a legitimate service. Upon loading, `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`. The process lineage is completed with `400619a.exe` spawning rundll32.exe, which is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary and may be any process on disk (typically system32/syswow64 binary). The `spawnto_` process will also contain a network connection. During triage, review parallel procesess and identify any additional file modifications.
+how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
+annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548"]}
+known_false_positives = False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule]
 type = detection
 asset_type = Endpoint
@@ -4939,6 +5130,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
 providing_technologies = []
 
+[savedsearch://ESCU - Suspicious Driver Loaded Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]}
+known_false_positives = Limited false positives will be present. Some applications do load drivers
+providing_technologies = []
+
 [savedsearch://ESCU - Suspicious Email - UBA Anomaly - Rule]
 type = detection
 asset_type = Endpoint
@@ -5045,6 +5246,16 @@ annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": [
 known_false_positives = Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
 providing_technologies = []
 
+[savedsearch://ESCU - Suspicious Process File Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious softtware. This behavior has been used by adversaries where they drop and run an exe in a path that is accessible without admin privileges.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]}
+known_false_positives = Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Suspicious Reg exe Process - Rule]
 type = detection
 asset_type = Endpoint
@@ -5495,6 +5706,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["
 known_false_positives = False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
 providing_technologies = []
 
+[savedsearch://ESCU - WinRM Spawning a Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies suspicious processes spawning from WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166. which is a kernel-mode device driver http.sys vulnerability. Current proof of concept code will blue-screen the operating system. However, http.sys used by many different Windows processes, including WinRM. In this case, identifying suspicious process create (child processes) from `wsmprovhost.exe` is what this analytic is identifying.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation", "Denial of Service"], "mitre_attack": ["T1190"]}
+known_false_positives = Unknown. Add new processes or filter as needed. It is possible system management software may spawn processes from `wsmprovhost.exe`.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows AdFind Exe - Rule]
 type = detection
 asset_type = Endpoint
@@ -5595,6 +5816,16 @@ annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T102
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - XMRIG Driver Loaded - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]}
+known_false_positives = False positives should be limited.
+providing_technologies = []
+
 [savedsearch://ESCU - aws detect attach to role policy - Rule]
 type = detection
 asset_type = AWS Account

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 28811
+build = 29832
 
 [triggers]
 reload.analytic_stories = simple
@@ -19,7 +19,7 @@ reload.content-version = simple
 
 [launcher]
 author = Splunk
-version = 3.21.0
+version = 3.22.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:46:44 UTC
+# On Date: 2021-05-24T20:38:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.21.0
+version = 3.22.0

dist/escu/default/data/ui/nav/default.xml

@@ -1,9 +1,7 @@
 <nav search_view="search" color="#65A637">
   <view name="escu_summary" default="true"/>
-  <view name="analytic_story_details"/>
-  <view name="explore_analytic_stories"/>
   <view name="feedback"/>
   <view name="search"/>
   <view name="escu_usage"/>
   <a href="http://docs.splunk.com/Documentation/ESSOC">Docs</a>
-</nav>
+</nav>

dist/escu/default/data/ui/views/escu_summary.xml

@@ -1,458 +1,242 @@
-<form script="escu_summary.js">
+<form theme="dark">
   <label>Content Library</label>
-  <description>Explore the Analytic Stories included with ES Content Updates.</description>
   <!-- Example uses stats transforming command -->
   <!-- This limits evnts passed to post-process search -->
-  <title>Content Library</title>
+  <title>Splunk Security Content</title>
+    <row>
+          <html>
+        <h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
+      </html>
+  </row>
   <search id="baseSS">
     <query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *"</query>
   </search>
   <search id="baseAS">
     <query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0</query>
   </search>
-  <row depends="$explore-use-case-es-show$">
-    <html>
-        <div id="explore-use-case-es-info" />
-    </html>
-  </row>
-
   <init>
-    <set token="form.as_cis">*</set>
     <set token="form.as_category">*</set>
-    <set token="form.cis_token">*</set>
-    <set token="form.searchtype">*</set>
+    <set token="form.detection">*</set>
+    <set token="form.as_story">*</set>
+    <set token="form.as_attack_id">*</set>
   </init>
-
-  <row id="tabs">
-        <panel>
-            <html>
-                <ul id="tabs_list" class="nav nav-tabs">
-                  <li class="active">
-                      <a href="#" class="toggle-tab es-soc-analytic-story-stats" data-toggle="tab" data-elements="analytic_stories_header_stats,analytic_stories_viz,kill_chain_viz,analytic_stories_details_table">
-                        Analytic Story Summary
-                      </a>
-                  </li>
-                  <li>
-                      <a href="#" class="toggle-tab es-soc-search-stats" data-toggle="tab" data-elements="search_stats_header,search_stats_viz,tab_search_type_table">
-                        Search Summary
-                      </a>
-                  </li>
-                </ul>
-            </html>
-        </panel>
-  </row>
-
   <!-- Rows for  Analytic Story Stats -->
-    <row id="analytic_stories_header_stats">
-        <panel>
-            <single>
-                <title>Total Analytic Stories</title>
-                <search base="baseAS">
-                <query>stats count</query>
-                </search>
-                <!-- post-process search -->
-                <option name="colorBy">value</option>
-                <option name="colorMode">block</option>
-                <option name="drilldown">none</option>
-                <option name="numberPrecision">0</option>
-                <option name="showSparkline">1</option>
-                <option name="showTrendIndicator">1</option>
-                <option name="trendColorInterpretation">standard</option>
-                <option name="trendDisplayMode">absolute</option>
-                <option name="unitPosition">after</option>
-                <option name="useColors">1</option>
-                <option name="useThousandSeparators">1</option>
-                <option name="rangeColors">["0x555","0x65a637"]</option>
-                <option name="rangeValues">[0]</option>
-            </single>
-        </panel>
-        <panel>
-            <single>
-                <title>ESCU App Version</title>
-                <search id="version">
-                    <query>| rest /services/configs/conf-content-version splunk_server=local count=0 | table version</query>
-                </search>
-                <option name="colorBy">value</option>
-                <option name="colorMode">block</option>
-                <option name="drilldown">none</option>
-                <option name="numberPrecision">0</option>
-                <option name="rangeColors">["0x555","0x65a637"]</option>
-                <option name="rangeValues">[0]</option>
-                <option name="refresh.display">progressbar</option>
-                <option name="showSparkline">1</option>
-                <option name="showTrendIndicator">1</option>
-                <option name="trendColorInterpretation">standard</option>
-                <option name="trendDisplayMode">absolute</option>
-                <option name="unitPosition">after</option>
-                <option name="useColors">1</option>
-                <option name="useThousandSeparators">1</option>
-            </single>
-        </panel>
-    </row>
-    <row id="analytic_stories_viz">
-        <panel>
-            <title>
-                Story Categories
-            </title>
-            <chart>
-                <search>
-                    <query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | stats count by category</query>
-                </search>
-                <drilldown>
-                    <set token="form.as_category">$click.value$</set>
-                    <set token="as_category" prefix="&quot;" suffix="&quot;">$click.value$</set>
-                </drilldown>
-                <option name="charting.chart">bar</option>
-                <option name="charting.drilldown">all</option>
-                <option name="charting.legend.placement">none</option>
-                <option name="charting.axisLabelsX.integerUnits">true</option>
-                <option name="charting.axisTitleX.visibility">collapsed</option>
-                <option name="charting.axisTitleY.visibility">collapsed</option>
-            </chart>
-        </panel>
-        <panel>
-            <title>
-                Analytic Stories by CIS Critical Security Control
-            </title>
-            <chart>
-                <search>
-                    <query>
-                    | rest /services/configs/conf-analytic_stories splunk_server=local count=0
-                    | spath input=mappings path=cis20{} output="cis"
-                    | rex field=cis "CIS\s(?&lt;num&gt;\d+)" | stats dc(title) as "Analytic Stories" by num | sort +num
-                    | rename num as "Critical Security Control"</query>
-                </search>
-                 <drilldown>
-                    <set token="form.as_cis">$click.value$</set>
-                    <set token="as_cis">$click.value$</set>
-                </drilldown>
-                <option name="charting.legend.placement">none</option>
-            </chart>
-        </panel>
-    </row>
-
-    <row id="kill_chain_viz">
-        <panel>
-            <title>Kill Chain Phases</title>
-            <html>
-                <div class="killchain-phases">
-                    <div class="killchain_card">
-                        <div class="killchain" style="background-color:#555;">
-                            <div class="killchain-text" id="reconnaissance">0</div>
-                        </div>
-                        <div>
-                            <p class="killchain-label">Reconnaissance</p>
-                        </div>
-                    </div>
-                    <div class="killchain_card notfirst">
-                        <div class="killchain" style="background-color:#675551;">
-                            <div class="killchain-text" id="weaponization">0</div>
-                        </div>
-                        <div>
-                            <p class="killchain-label">Weaponization</p>
-                        </div>
-                    </div>
-                    <div class="killchain_card notfirst">
-                        <div class="killchain" style="background-color:#78554E;">
-                            <div class="killchain-text" id="delivery">0</div>
-                        </div>
-                        <div>
-                            <p class="killchain-label">Delivery</p>
-                        </div>
-                    </div>
-                    <div class="killchain_card notfirst">
-                        <div class="killchain" style="background-color:#8A554B;">
-                            <div class="killchain-text" id="exploitation">0</div>
-                        </div>
-                        <div>
-                            <p class="killchain-label">Exploitation</p>
-                        </div>
-                    </div>
-                    <div class="killchain_card notfirst">
-                        <div class="killchain" style="background-color:#9C5647;">
-                            <div class="killchain-text" id="installation">0</div>
-                        </div>
-                        <div>
-                            <p class="killchain-label">Installation</p>
-                        </div>
-                    </div>
-                    <div class="killchain_card notfirst">
-                        <div class="killchain" style="background-color:#AD5644;">
-                            <div class="killchain-text" id="commandandcontrol">0</div>
-                        </div>
-                        <div>
-                            <p class="killchain-label">Command &amp; Control</p>
-                        </div>
-                    </div>
-                    <div class="killchain_card notfirst">
-                        <div class="killchain" style="background-color:#D6563C;">
-                            <div class="killchain-text" id="actionsonobjectives">0</div>
-                        </div>
-                        <div>
-                            <p class="killchain-label">Actions on Objectives</p>
-                        </div>
-                    </div>
-                </div>
-            </html>
-        </panel>
-    </row>
-
   <!-- Rows for  Analytic Story Table -->
-    <row id="analytic_stories_details_table">
-        <panel>
-        <input type="dropdown" token="as_category">
-            <label>Category</label>
-            <choice value="*">All</choice>
-            <search base="baseAS">
-                <latest>now</latest>
-                <query>| dedup category | fields category</query>
-            </search>
-            <fieldForLabel>category</fieldForLabel>
-            <fieldForValue>category</fieldForValue>
-            <default>*</default>
-            <prefix>"</prefix>
-            <suffix>"</suffix>
-        </input>
-        <input type="dropdown" token="as_kill_chain_phase">
-            <label>Kill Chain Phases</label>
-            <choice value="*">All</choice>
-            <choice value="Reconnaissance">Reconnaissance</choice>
-            <choice value="Weaponization">Weaponization</choice>
-            <choice value="Delivery">Delivery</choice>
-            <choice value="Exploitation">Exploitation</choice>
-            <choice value="Installation">Installation</choice>
-            <choice value="Command and Control">Command &amp; Control</choice>
-            <choice value="Actions on Objectives">Actions on Objectives</choice>
-            <prefix>"</prefix>
-            <suffix>"</suffix>
-            <default>*</default>
-        </input>
-        <input type="dropdown" token="as_data_models">
-            <label>Data Models</label>
-            <choice value="*">All</choice>
-            <search base="baseAS">
-                <latest>now</latest>
-                <query>| spath input=data_models path={} output=dm | mvexpand dm | dedup dm | fields dm</query>
-            </search>
-            <fieldForLabel>dm</fieldForLabel>
-            <fieldForValue>dm</fieldForValue>
-            <default>*</default>
-            <prefix>"</prefix>
-            <suffix>"</suffix>
-        </input>
-        <input type="dropdown" token="as_cis">
-            <label>CIS Critical Security Controls</label>
-            <choice value="*">All</choice>
-            <search base="baseAS">
-                <latest>now</latest>
-                <query>
-                    | spath input=mappings path=cis20{} output=cis
-                    | rex field=cis "CIS\s(?&lt;num&gt;\d+)"
-                    | fields num
-                    | mvexpand num
-                    | dedup num
-                    | sort +num
-                </query>
-            </search>
-            <fieldForLabel>num</fieldForLabel>
-            <fieldForValue>num</fieldForValue>
-            <default>*</default>
-            <prefix>"</prefix>
-            <suffix>"</suffix>
-        </input>
-        <html>
+  <!-- Rows for  Search Stats -->
+  <fieldset submitButton="false"></fieldset>
+  <row depends="$explore-use-case-es-show$">
+    <panel>
+      <html>
+        <div id="explore-use-case-es-info"/>
+    </html>
+    </panel>
+  </row>
+  <row id="analytic_stories_header_stats">
+    <panel>
+      <single>
+        <title>Total Analytic Stories</title>
+        <search base="baseAS">
+          <query>stats count</query>
+        </search>
+        <!-- post-process search -->
+        <option name="colorBy">value</option>
+        <option name="colorMode">block</option>
+        <option name="drilldown">none</option>
+        <option name="numberPrecision">0</option>
+        <option name="showSparkline">1</option>
+        <option name="showTrendIndicator">1</option>
+        <option name="trendColorInterpretation">standard</option>
+        <option name="trendDisplayMode">absolute</option>
+        <option name="unitPosition">after</option>
+        <option name="useColors">1</option>
+        <option name="useThousandSeparators">1</option>
+        <option name="rangeColors">["0x555","0x65a637"]</option>
+        <option name="rangeValues">[0]</option>
+      </single>
+    </panel>
+    <panel>
+      <single>
+        <title>Total Detections</title>
+        <search base="baseSS">
+      <query>stats count by action.correlationsearch.label|  eventstats sum(count) as total_detection_count|  fields total_detection_count</query>
+        </search>
+        <!-- post-process search -->
+        <option name="colorBy">value</option>
+        <option name="colorMode">block</option>
+        <option name="drilldown">none</option>
+        <option name="numberPrecision">0</option>
+        <option name="showSparkline">1</option>
+        <option name="showTrendIndicator">1</option>
+        <option name="trendColorInterpretation">standard</option>
+        <option name="trendDisplayMode">absolute</option>
+        <option name="unitPosition">after</option>
+        <option name="useColors">1</option>
+        <option name="useThousandSeparators">1</option>
+        <option name="rangeColors">["0x555","0x65a637"]</option>
+        <option name="rangeValues">[0]</option>
+      </single>
+    </panel>
+    <panel>
+      <single>
+        <title>ESCU App Version</title>
+        <search id="version">
+          <query>| rest /services/configs/conf-content-version splunk_server=local count=0 | table version</query>
+        </search>
+        <option name="colorBy">value</option>
+        <option name="colorMode">block</option>
+        <option name="drilldown">none</option>
+        <option name="numberPrecision">0</option>
+        <option name="rangeColors">["0x555","0x65a637"]</option>
+        <option name="rangeValues">[0]</option>
+        <option name="refresh.display">progressbar</option>
+        <option name="showSparkline">1</option>
+        <option name="showTrendIndicator">1</option>
+        <option name="trendColorInterpretation">standard</option>
+        <option name="trendDisplayMode">absolute</option>
+        <option name="unitPosition">after</option>
+        <option name="useColors">1</option>
+        <option name="useThousandSeparators">1</option>
+      </single>
+    </panel>
+  </row>
+  <row id="analytic_stories_viz">
+    <panel>
+      <title>Story Categories</title>
+      <chart>
+        <search>
+          <query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | stats count by category</query>
+        </search>
+        <drilldown>
+          <set token="form.as_category">$click.value$</set>
+          <set token="as_category" prefix="&quot;" suffix="&quot;">$click.value$</set>
+        </drilldown>
+        <option name="charting.chart">bar</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.legend.placement">none</option>
+        <option name="charting.axisLabelsX.integerUnits">true</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+      </chart>
+    </panel>
+    <panel>
+      <title>Analytic Stories by MITRE Technique ID</title>
+      <chart>
+        <search>
+          <query>
+                    | rest /services/configs/conf-analytic_stories splunk_server=local count=0
+                    | spath input=mappings path=mitre_attack{} output="MITRE Technique ID"
+                    | stats dc(title) as "Analytic Stories" by "MITRE Technique ID"
+          </query>
+        </search>
+        <drilldown>
+          <set token="form.as_attack_id">$click.value$</set>
+          <set token="as_attack_id">$click.value$</set>
+        </drilldown>
+        <option name="charting.legend.placement">none</option>
+      </chart>
+    </panel>
+  </row>
+  <row id="analytic_stories_details_table">
+    <panel>
+      <input type="dropdown" token="as_story">
+        <label>Analytic Story</label>
+        <choice value="*">All</choice>
+        <search base="baseAS">
+          <latest>now</latest>
+          <query>| dedup title | rename title as story | fields story</query>
+        </search>
+        <fieldForLabel>story</fieldForLabel>
+        <fieldForValue>story</fieldForValue>
+        <default>*</default>
+        <prefix>"</prefix>
+        <suffix>"</suffix>
+      </input>
+      <input type="dropdown" token="detection">
+        <label>Detections</label>
+        <choice value="*">All</choice>
+        <search base="baseSS">
+          <latest>now</latest>
+          <query>rename action.correlationsearch.label as Detection | dedup Detection |  fields Detection</query>
+        </search>
+        <fieldForLabel>Detection</fieldForLabel>
+        <fieldForValue>Detection</fieldForValue>
+        <prefix>"</prefix>
+        <suffix>"</suffix>
+        <default>*</default>
+      </input>
+      <input type="dropdown" token="as_category">
+        <label>Category</label>
+        <choice value="*">All</choice>
+        <search base="baseAS">
+          <latest>now</latest>
+          <query>| dedup category | fields category</query>
+        </search>
+        <fieldForLabel>category</fieldForLabel>
+        <fieldForValue>category</fieldForValue>
+        <default>*</default>
+        <prefix>"</prefix>
+        <suffix>"</suffix>
+      </input>
+      <input type="dropdown" token="as_attack_id">
+        <label>MITRE Technique ID</label>
+        <choice value="*">All</choice>
+        <search base="baseAS">
+          <latest>now</latest>
+          <query>| spath input=mappings path=mitre_attack{} output="MITRE Technique ID" | mvexpand "MITRE Technique ID"| dedup "MITRE Technique ID" | fields "MITRE Technique ID"</query>
+        </search>
+        <fieldForLabel>MITRE Technique ID</fieldForLabel>
+        <fieldForValue>MITRE Technique ID</fieldForValue>
+        <prefix>"</prefix>
+        <suffix>"</suffix>
+        <default>*</default>
+      </input>
+      <input type="dropdown" token="as_data_models">
+        <label>Data Models</label>
+        <choice value="*">All</choice>
+        <search base="baseAS">
+          <latest>now</latest>
+          <query>| spath input=data_models path={} output=dm | mvexpand dm | dedup dm | fields dm</query>
+        </search>
+        <fieldForLabel>dm</fieldForLabel>
+        <fieldForValue>dm</fieldForValue>
+        <default>*</default>
+        <prefix>"</prefix>
+        <suffix>"</suffix>
+      </input>
+      <html>
             <input id="analytic_filter_clear" class="btn btn-primary" type="button" value="Clear All"/>
         </html>
-        <table>
-            <title>Analytic Story Details</title>
-            <search base="baseAS">
-            <query>
+      <table>
+        <title>Analytic Story Details</title>
+        <search base="baseAS">
+          <query>
                 spath input=data_models path={} output="Data Models"
                 | spath input=mappings path=kill_chain_phases{} output="Kill Chain Phases"
-                | spath input=mappings path=cis20{} output=cis
-                | rex field=cis "CIS\s(?&lt;num&gt;\d+)"
-                | rename num as CIS
-                | rename title as "Analytic Story" description as "Description" category as "Category" creation_date as "Created" modification_date as "Last Updated"
+                | spath input=detection_searches path={} output="Detections"
+                | spath input=mappings path=mitre_attack{} output="MITRE Technique ID"
+                | rename title as "Analytic Story" description as "Description" category as "Category" modification_date as "Last Updated"
                 | fillnull value="-"
+                | search "Analytic Story"=$as_story$
                 | search "Data Models"=$as_data_models$
-                | search "Kill Chain Phases"=$as_kill_chain_phase$
                 | search "Category"=$as_category$
-                | search CIS=$as_cis$
-                | table "Analytic Story" Description Category "Kill Chain Phases" , CIS, "Data Models" "Created" "Last Updated"</query>
-            </search>
-            <drilldown>
-                <link target="_blank">
-                    <![CDATA[
-                    /app/DA-ESS-ContentUpdate/analytic_story_details?hideFilters=true&form.analytic_story_name=$row.Analytic Story$
-                    ]]>
-                </link>
-            </drilldown>
-            <option name="drilldown">row</option>
-            <option name="wrap">true</option>
-            <option name="rowNumbers">true</option>
-            <option name="dataOverlayMode">none</option>
-            <option name="count">5</option>
-        </table>
-        </panel>
-    </row>
-  <!-- Rows for  Search Stats -->
-    <row id="search_stats_header">
-        <panel>
-            <single>
-                <title>Total Searches</title>
-                <search base="baseSS">
-                <query>stats count</query>
-                </search>
-                <!-- post-process search -->
-                <option name="colorBy">value</option>
-                <option name="colorMode">block</option>
-                <option name="drilldown">none</option>
-                <option name="numberPrecision">0</option>
-                <option name="showSparkline">1</option>
-                <option name="showTrendIndicator">1</option>
-                <option name="trendColorInterpretation">standard</option>
-                <option name="trendDisplayMode">absolute</option>
-                <option name="unitPosition">after</option>
-                <option name="useColors">1</option>
-                <option name="useThousandSeparators">1</option>
-                <option name="rangeColors">["0x555","0x65a637"]</option>
-                <option name="rangeValues">[0]</option>
-            </single>
-        </panel>
-    </row>
-    <row id="search_stats_viz">
-        <panel>
-            <title>
-                Searches by CIS Critical Security Control
-            </title>
-            <chart>
-                <title></title>
-                <search>
-                <query>
-                    | rest /services/saved/searches splunk_server=local count=0
-                    | search title="ESCU - *" action.escu.search_type=detection
-                    | spath input=action.escu.analytic_story path={} output=uc | mvexpand uc
-                    | spath input=action.escu.mappings path=cis20{} output=cis
-                    | rex field=cis "CIS\s(?&lt;num&gt;\d+)"
-                    | stats dc(action.escu.full_search_name) AS Searches by num
-                    | sort +num | rename num AS "Critical Security Control"
-                </query>
-                <earliest>-24h</earliest>
-                <latest>now</latest>
-                </search>
-                <drilldown>
-                    <set token="form.cis_token">$click.value$</set>
-                    <set token="cis_token">$click.value$</set>
-                </drilldown>
-            </chart>
-        </panel>
-        <panel>
-            <title>
-                Search Types
-            </title>
-            <chart>
-                <search>
-                <query>
-                | rest /services/saved/searches splunk_server=local count=0
-                | search title="ESCU - *" | rename action.escu.search_type AS search_type
-                | eval search_type = upper(substr(search_type,1,1)) + lower(substr(search_type,2))
-                | stats count by search_type
-                </query>
-                </search>
-                <drilldown>
-                    <set token="searchtype">$click.value$</set>
-                    <set token="form.searchtype">$click.value$</set>
-                </drilldown>
-                <option name="charting.chart">bar</option>
-                <option name="charting.drilldown">all</option>
-                <option name="charting.legend.placement">none</option>
-                <option name="charting.axisTitleX.visibility">collapsed</option>
-                <option name="charting.axisTitleY.visibility">collapsed</option>
-            </chart>
-        </panel>
-    </row>
-    <row id="tab_search_type_table">
-        <panel>
-            <input type="dropdown" token="searchtype">
-                <label>Search Type</label>
-                <choice value="*">All</choice>
-                <choice value="detection">Detection</choice>
-                <choice value="investigative">Investigative</choice>
-                <choice value="contextual">Contextual</choice>
-                <choice value="support">Support</choice>
-                <default>$searchtype$</default>
-            </input>
-            <input type="dropdown" token="kill_chain_phase">
-                <label>Kill Chain Phases</label>
-                <choice value="*">All</choice>
-                <choice value="Reconnaissance">Reconnaissance</choice>
-                <choice value="Weaponization">Weaponization</choice>
-                <choice value="Delivery">Delivery</choice>
-                <choice value="Exploitation">Exploitation</choice>
-                <choice value="Installation">Installation</choice>
-                <choice value="Command and Control">Command &amp; Control</choice>
-                <choice value="Actions on Objectives">Actions on Objectives</choice>
-                <prefix>"</prefix>
-                <suffix>"</suffix>
-                <default>*</default>
-            </input>
-            
-            <input type="dropdown" token="data_models">
-                <label>Data Models</label>
-                <choice value="*">All</choice>
-                <search base="baseSS">
-                    <latest>now</latest>
-                    <query>| spath input=action.escu.data_models path={} output=dm | dedup dm | fields dm</query>
-                </search>
-                <fieldForLabel>dm</fieldForLabel>
-                <fieldForValue>dm</fieldForValue>
-                <default>*</default>
-                <prefix>"</prefix>
-                <suffix>"</suffix>
-            </input>
-            <input type="dropdown" token="cis_token">
-                <label>CIS Critical Security Controls</label>
-                <choice value="*">All</choice>
-                <search base="baseSS">
-                    <latest>now</latest>
-                    <query>
-                        | spath input=action.escu.mappings path=cis20{} output=cis
-                        | rex field=cis "CIS\s(?&lt;num&gt;\d+)"
-                        | mvexpand num
-                        | dedup num
-                        | sort +num
-                        | fields num
-                    </query>
-                </search>
-                <fieldForLabel>num</fieldForLabel>
-                <fieldForValue>num</fieldForValue>
-                <default>*</default>
-                <prefix>"</prefix>
-                <suffix>"</suffix>
-            </input>
-            <html>
-                <input id="search_filter_clear" class="btn btn-primary" type="button" value="Clear All"/>
-            </html>
-            <table id="type">
-                <title>Search Details</title>
-                <search base="baseSS">
-                <query>
-                spath input=action.escu.data_models path={} output="Data Models"
-                | spath input=action.escu.mappings path=kill_chain_phases{} output="Kill Chain Phases"
-                | spath input=action.escu.mappings path=cis20{} output=cis
-                | rex field=cis "CIS\s(?&lt;num&gt;\d+)"
-                | rename num as CIS
-                | fillnull value="-"
-                | search CIS=$cis_token$
-                | search "Data Models"=$data_models$
-                | search "Kill Chain Phases"=$kill_chain_phase$
-                | search action.escu.search_type=$searchtype$
-                | rename action.escu.asset_at_risk AS "Asset at Risk" | rename title as "Search Name"| rename modification_date as "Last Updated"
-                | table "Search Name" description "Kill Chain Phases" CIS "Data Models" "Last Updated"</query>
-                <earliest>0</earliest>
-                <latest></latest>
-                </search>
-            </table>
-        </panel>
-    </row>
-</form>
+                | search "MITRE Technique ID"=$as_attack_id$
+                | search "Detections"=$detection$
+                | table "Analytic Story", Description, Category, "MITRE Technique ID", "Data Models", Detections, "Last Updated"
+           </query>
+        </search>
+        <drilldown>
+          <link target="_blank">
+            <![CDATA[
+              /app/SplunkEnterpriseSecuritySuite/ess_analytic_story_details?analytic_story=$row.Analytic Story$
+            ]]>
+          </link>
+        </drilldown>
+        <option name="drilldown">row</option>
+        <option name="wrap">true</option>
+        <option name="rowNumbers">true</option>
+        <option name="dataOverlayMode">none</option>
+        <option name="count">5</option>
+      </table>
+    </panel>
+  </row>
+</form>

dist/escu/default/data/ui/views/explore_analytic_stories.xml

@@ -1,81 +0,0 @@
-<form script="escu_summary.js">
-  <label>Keyword Search</label>
-  <search id="baseAS">
-    <query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 |
-search (title=*$field1$* OR description=*$field1$* OR narrative=*$field1$* OR detection_searches=*$field1$*)</query>
-  </search>
-  <search id="baseSS">
-    <query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" |
-search (title=*$field1$* OR description=*$field1$* OR search=*$field1$*  OR action.escu.mappings=*$field1$* OR action.escu.search_type=*$field1$* OR action.escu.eli5 =*$field1$* )
-  </query>
-  </search>
-  <fieldset submitButton="true">
-    <input type="text" token="field1" searchWhenChanged="true">
-      <label>Enter a keyword in the box below.</label>
-      <default>*</default>
-    </input>
-  </fieldset>
-  <row id="tabs">
-    <panel>
-      <html>
-
-
-                <ul id="tabs_list" class="nav nav-tabs">
-                  <li class="active">
-                      <a href="#"  data-toggle="tab" data-elements="analytic">
-                        Analytic Story Results
-                      </a>
-                  </li>
-                  <li>
-                      <a href="#"  data-toggle="tab" data-elements="search">
-                        Search Results
-                      </a>
-                  </li>
-                </ul>
-            </html>
-    </panel>
-  </row>
-  <row id="analytic">
-    <panel>
-      <title>Analytic Story Results</title>
-      <table>
-        <title>For Analytic Stories, the search looks for matches in the story description, title, or narrative fields, as well as the names of the detection searches. In the "Search Results" tab, you'll see matches that appear in the title, description, type, or "Explain it like I'm 5" field, or in the searches themselves.  An asterisk (*) entered in the search box will list all of the Analytic Stories and searches contained within them.</title>
-        <search base="baseAS">
-          <query>| makemv delim="," allowempty=t detection_searches
-            | rex field=detection_searches "\W+(?&lt;"Detection_Searches"&gt;.*)\W+"
-            | eval Detection_Searches=trim(Detection_Searches, "/\"")
-            | table title  description  Detection_Searches
-            | rename title AS "Analytic Story"</query>
-        </search>
-        <option name="count">10</option>
-        <option name="dataOverlayMode">none</option>
-        <option name="drilldown">cell</option>
-        <option name="rowNumbers">true</option>
-        <option name="wrap">true</option>
-        <drilldown>
-          <link target="_blank">
-            <![CDATA[
-                    /app/DA-ESS-ContentUpdate/analytic_story_details?hideFilters=true&form.analytic_story_name=$row.Analytic Story$
-                    ]]>
-          </link>
-        </drilldown>
-      </table>
-    </panel>
-  </row>
-  <row id="search">
-    <panel>
-      <title>Search Results</title>
-      <table>
-        <title>Below are keyword matches that appear in the title, description, type, or "Explain it like I'm 5" field or in the search itself. An asterisk (*) entered in the search box will list all of the searches from all of the Analytic Stories.</title>
-        <search base="baseSS">
-          <query>|rename title as "Search Name" action.escu.search_type as "Search type" action.escu.mappings as "Mappings" action.escu.eli5 as "ELI5"| table "Search type","Search Name", description, search</query>
-        </search>
-        <option name="count">10</option>
-        <option name="dataOverlayMode">none</option>
-        <option name="drilldown">row</option>
-        <option name="rowNumbers">true</option>
-        <option name="wrap">true</option>
-      </table>
-    </panel>
-  </row>
-</form>

dist/escu/default/es_investigations.conf

@@ -706,6 +706,13 @@ disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]
 
+[panel_group://workbench_panel_group_xmrig]
+label = XMRig
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 
 
 [panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task]

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:46:44 UTC
+# On Date: 2021-05-24T20:38:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -635,6 +635,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[deleting_of_net_users_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [deleting_shadow_copies_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -979,6 +983,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[disable_windows_app_hotkeys_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [disable_windows_behavior_monitoring_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1003,6 +1011,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[disabling_net_user_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [disabling_norun_windows_app_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1019,6 +1031,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[download_files_using_telegram_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [dump_lsass_via_comsvcs_dll_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1063,6 +1079,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[enumerate_users_local_group_using_telegram_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [eventvwr_uac_bypass_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1075,14 +1095,38 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[excessive_attempt_to_disable_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [excessive_dns_failures_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[excessive_service_stop_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_cacls_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_taskkill_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [excessive_usage_of_nslookup_app_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[executables_or_script_creation_in_suspicious_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [execution_of_file_with_spaces_before_extension_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1147,6 +1191,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[hide_user_account_from_sign_in_screen_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [hiding_files_and_directories_with_attrib_exe_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1167,6 +1215,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[icacls_grant_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[icacls_deny_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [identify_new_user_accounts_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1283,6 +1339,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[modify_acl_permission_to_files_or_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [monitor_dns_for_brand_abuse_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1487,6 +1547,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[process_kill_base_on_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [processes_tapping_keyboard_events_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1627,6 +1691,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[schtasks_run_task_on_demand_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [schtasks_scheduling_job_on_remote_system_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1643,6 +1711,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[services_escalate_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1695,6 +1767,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[suspicious_driver_loaded_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [suspicious_email___uba_anomaly_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1731,6 +1807,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[suspicious_process_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [suspicious_reg_exe_process_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1907,6 +1987,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[winrm_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_adfind_exe_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1947,6 +2031,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[xmrig_driver_loaded_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [aws_detect_attach_to_role_policy_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:46:44 UTC
+# On Date: 2021-05-24T20:38:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/use_case_library.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:46:44 UTC
+# On Date: 2021-05-24T20:38:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -220,7 +220,7 @@ version = 1
 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"]
+searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"]
 description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility.
 narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\
 Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\
@@ -354,7 +354,7 @@ The searches in this Analytic Story help you detect and investigate activities t
 
 [analytic_story://DarkSide Ransomware]
 category = Malware
-last_updated = 2020-06-12
+last_updated = 2021-05-12
 version = 1
 references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
@@ -370,7 +370,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0010/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Get Notable History - Response Task"]
 description = The stealing of data by an adversary.
 narrative = Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command and Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.
 
@@ -1218,7 +1218,7 @@ version = 2
 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\
 This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\
@@ -1333,6 +1333,17 @@ searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg
 description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection.
 
+[analytic_story://XMRig]
+category = Malware
+last_updated = 2021-05-07
+version = 1
+references = ["https://github.com/xmrig/xmrig", "https://www.getmonero.org/resources/user-guides/mine-to-pool.html", "https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"]
+maintainers = [{"company": "Rod Soto Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.
+narrative = XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. This monero is seen in the wild on May 2017.
+
 ### END STORIES ###
 
 ### DETECTIONS ###
@@ -2217,6 +2228,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Deleting Of Net Users - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
+known_false_positives = System administrators or scripts may delete user accounts via this technique. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Deleting Shadow Copies - Rule]
 type = detection
 asset_type = Endpoint
@@ -3112,6 +3133,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.00
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Disable Windows App Hotkeys - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems.
+how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Disable Windows Behavior Monitoring - Rule]
 type = detection
 asset_type = 
@@ -3172,6 +3203,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = admin may disable this application for non technical user.
 providing_technologies = []
 
+[savedsearch://ESCU - Disabling Net User Account - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Disabling NoRun Windows App - Rule]
 type = detection
 asset_type = 
@@ -3212,6 +3253,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = admin may disable this application for non technical user.
 providing_technologies = []
 
+[savedsearch://ESCU - Download Files Using Telegram - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
+known_false_positives = normal download of file in telegram app. (if it was a common app in network)
+providing_technologies = []
+
 [savedsearch://ESCU - Dump LSASS via comsvcs DLL - Rule]
 type = detection
 asset_type = Endpoint
@@ -3326,6 +3377,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
 providing_technologies = []
 
+[savedsearch://ESCU - Enumerate Users Local Group Using Telegram - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Eventvwr UAC Bypass - Rule]
 type = detection
 asset_type = 
@@ -3356,6 +3417,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.00
 known_false_positives = False positives should be limited, but if any are present, filter as needed. In some instances, `cscript.exe` is used for legitimate business practices.
 providing_technologies = []
 
+[savedsearch://ESCU - Excessive Attempt To Disable Services - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Excessive DNS Failures - Rule]
 type = detection
 asset_type = Endpoint
@@ -3366,6 +3437,46 @@ annotations = {"cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Com
 known_false_positives = It is possible legitimate traffic can trigger this rule. Please investigate as appropriate. The threshold for generating an event can also be customized to better suit your environment.
 providing_technologies = []
 
+[savedsearch://ESCU - Excessive Service Stop Attempt - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - Excessive Usage Of Cacls App - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application to change file or folder permission. This behavior is commonly seen where the adversary attempts to impair some users from deleting or accessing its malware components or artifact from the compromised system.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = Administrators or administrative scripts may use this application. Filter as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Excessive Usage Of Net App - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies excessive usage of `net.exe` or `net1.exe` within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its malicious behavior.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
+known_false_positives = unknown. Filter as needed. Modify the time span as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Excessive Usage Of Taskkill - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = Unknown. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Excessive Usage of NSLOOKUP App - Rule]
 type = detection
 asset_type = 
@@ -3376,6 +3487,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]}
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Executables Or Script Creation In Suspicious Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"]}
+known_false_positives = Administrators may allow creation of script or exe in the paths specified. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Execution of File With Spaces Before Extension - Rule]
 type = detection
 asset_type = Endpoint
@@ -3540,6 +3661,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
 providing_technologies = []
 
+[savedsearch://ESCU - Hide User Account From Sign-In Screen - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine.
+how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = Unknown. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Hiding Files And Directories With Attrib exe - Rule]
 type = detection
 asset_type = 
@@ -3590,6 +3721,26 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
 providing_technologies = []
 
+[savedsearch://ESCU - ICACLS Grant Command - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component files.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = Unknown. Filter as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Icacls Deny Command - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = Unknown. It is possible some administrative scripts use ICacls. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Identify New User Accounts - Rule]
 type = detection
 asset_type = Domain Server
@@ -3880,6 +4031,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["
 known_false_positives = Creating a hidden powershell service is rare and could key off of those instances.
 providing_technologies = []
 
+[savedsearch://ESCU - Modify ACL permission To Files Or Folder - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
+known_false_positives = administrators may use this command. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Monitor DNS For Brand Abuse - Rule]
 type = detection
 asset_type = Endpoint
@@ -4416,6 +4577,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = Although unlikely, administrators may use wmi to execute commands for legitimate purposes.
 providing_technologies = []
 
+[savedsearch://ESCU - Process Kill Base On File Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed wmic.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
+known_false_positives = Unknown.
+providing_technologies = []
+
 [savedsearch://ESCU - Processes Tapping Keyboard Events - Rule]
 type = detection
 asset_type = Endpoint
@@ -4743,7 +4914,7 @@ providing_technologies = []
 type = detection
 asset_type = 
 confidence = medium
-explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
+explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]}
 known_false_positives = unknown
@@ -4769,6 +4940,16 @@ annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = No known false positives
 providing_technologies = []
 
+[savedsearch://ESCU - Schtasks Run Task On Demand - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies an on demand run of a Windows Schedule Task through shell or command-line. This technique has been used by adversaries that force to run their created Schedule Task as their persistence mechanism or for lateral movement as part of their malicious attack to the compromised machine.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]}
+known_false_positives = Administrators may use to debug Schedule Task entries. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Schtasks scheduling job on remote system - Rule]
 type = detection
 asset_type = Endpoint
@@ -4809,6 +4990,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
 providing_technologies = []
 
+[savedsearch://ESCU - Services Escalate Exe - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the use of `svc-exe` with Cobalt Strike. The behavior typically follows after an adversary has already gained initial access and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following, the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\` with multiple keys and values added to look like a legitimate service. Upon loading, `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`. The process lineage is completed with `400619a.exe` spawning rundll32.exe, which is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary and may be any process on disk (typically system32/syswow64 binary). The `spawnto_` process will also contain a network connection. During triage, review parallel procesess and identify any additional file modifications.
+how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
+annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548"]}
+known_false_positives = False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule]
 type = detection
 asset_type = Endpoint
@@ -4939,6 +5130,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
 providing_technologies = []
 
+[savedsearch://ESCU - Suspicious Driver Loaded Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]}
+known_false_positives = Limited false positives will be present. Some applications do load drivers
+providing_technologies = []
+
 [savedsearch://ESCU - Suspicious Email - UBA Anomaly - Rule]
 type = detection
 asset_type = Endpoint
@@ -5045,6 +5246,16 @@ annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": [
 known_false_positives = Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
 providing_technologies = []
 
+[savedsearch://ESCU - Suspicious Process File Path - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious softtware. This behavior has been used by adversaries where they drop and run an exe in a path that is accessible without admin privileges.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]}
+known_false_positives = Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Suspicious Reg exe Process - Rule]
 type = detection
 asset_type = Endpoint
@@ -5495,6 +5706,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["
 known_false_positives = False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
 providing_technologies = []
 
+[savedsearch://ESCU - WinRM Spawning a Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies suspicious processes spawning from WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166. which is a kernel-mode device driver http.sys vulnerability. Current proof of concept code will blue-screen the operating system. However, http.sys used by many different Windows processes, including WinRM. In this case, identifying suspicious process create (child processes) from `wsmprovhost.exe` is what this analytic is identifying.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation", "Denial of Service"], "mitre_attack": ["T1190"]}
+known_false_positives = Unknown. Add new processes or filter as needed. It is possible system management software may spawn processes from `wsmprovhost.exe`.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows AdFind Exe - Rule]
 type = detection
 asset_type = Endpoint
@@ -5595,6 +5816,16 @@ annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T102
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - XMRIG Driver Loaded - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]}
+known_false_positives = False positives should be limited.
+providing_technologies = []
+
 [savedsearch://ESCU - aws detect attach to role policy - Rule]
 type = detection
 asset_type = AWS Account

dist/saaws/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS_AmazonWebServices_Content", 
-      "version": "3.21.0"
+      "version": "3.22.0"
     }, 
     "author": [
       {

dist/saaws/default/analytic_stories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:47:01 UTC
+# On Date: 2021-05-24T20:39:00 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/saaws/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-05-13T21:47:01 UTC
+# On Date: 2021-05-24T20:39:00 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############