Branch was auto-updated.

detections/endpoint/add_or_set_windows_defender_exclusion.yml

@@ -34,6 +34,7 @@ tags:
   - Remcos
   - Windows Defense Evasion Tactics
   - WhisperGate
+  - AgentTesla
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/disabling_remote_user_account_control.yml

@@ -29,6 +29,7 @@ tags:
   - Remcos
   - Windows Registry Abuse
   - Azorult
+  - AgentTesla
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -49,6 +49,7 @@ tags:
   - AgentTesla
   - Qakbot
   - IcedID
+  - Trickbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/office_application_spawn_regsvr32_process.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Qakbot
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -35,6 +35,8 @@ tags:
   - DarkCrystal RAT
   - Azorult
   - Remcos
+  - Qakbot
+  - AgentTesla
   confidence: 80
   context:
   - Source:Endpoint
@@ -47,8 +49,8 @@ tags:
   message: an office product parent process $parent_process_name$ spawn child process
     $process_name$ in host $dest$
   mitre_attack_id:
-  - T1218
-  - T1218.005
+  - T1566
+  - T1566.001
   observable:
   - name: dest
     type: Hostname

detections/endpoint/office_product_spawning_certutil.yml

@@ -35,6 +35,8 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - AgentTesla
+  - Trickbot
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/office_product_spawning_mshta.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - IcedID
+  - Azorult
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/powershell_windows_defender_exclusion_commands.yml

@@ -30,6 +30,7 @@ tags:
   - Remcos
   - Windows Defense Evasion Tactics
   - WhisperGate
+  - AgentTesla
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -37,6 +37,7 @@ tags:
   - CISA AA22-257A
   - AgentTesla
   - Qakbot
+  - Trickbot
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/services_exe_lolbas_execution_process_spawn.yml

@@ -42,6 +42,7 @@ tags:
   analytic_story:
   - Active Directory Lateral Movement
   - Living Off The Land
+  - Qakbot
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/suspicious_copy_on_system32.yml

@@ -30,6 +30,8 @@ references:
 tags:
   analytic_story:
   - Unusual Processes
+  - Qakbot
+  - IcedID
   confidence: 90
   context:
   - Stage:Execution

detections/endpoint/suspicious_driver_loaded_path.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - AgentTesla
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/suspicious_process_file_path.yml

@@ -45,6 +45,8 @@ tags:
   - AgentTesla
   - Qakbot
   - IcedID
+  - Trickbot
+  - Azorult
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml

@@ -22,6 +22,7 @@ tags:
   analytic_story:
   - Living Off The Land
   - Windows Defense Evasion Tactics
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_driver_load_non_standard_path.yml

@@ -22,6 +22,7 @@ references:
 tags:
   analytic_story:
   - Windows Drivers
+  - AgentTesla
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_drivers_loaded_by_signature.yml

@@ -25,6 +25,7 @@ references:
 tags:
   analytic_story:
   - Windows Drivers
+  - AgentTesla
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -1,7 +1,7 @@
 name: Windows Service Created with Suspicious Service Path
 id: 429141be-8311-11eb-adb6-acde48001122
 version: 3
-date: '2022-08-26'
+date: '2022-11-14'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -11,8 +11,8 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa
   alike may create malicious Services for lateral movement or remote code execution
   as well as persistence and execution. The Clop ransomware has also been seen in
   the wild abusing Windows services.
-search: ' `wineventlog_system` EventCode=7045  Service_File_Name = "*\.exe" NOT (Service_File_Name
-  IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*"))
+search: ' `wineventlog_system` EventCode=7045  Service_File_Name = "*.exe" NOT (Service_File_Name
+  IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*"))
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
   Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`'
@@ -29,6 +29,7 @@ tags:
   - Clop Ransomware
   - Active Directory Lateral Movement
   - Brute Ratel C4
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint