Branch was auto-updated.

detections/deprecated/dump_lsass_via_procdump_rename.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - Azorult
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6

detections/endpoint/detect_exchange_web_shell.yml

@@ -51,6 +51,7 @@ tags:
   analytic_story:
   - HAFNIUM Group
   - ProxyShell
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -30,6 +30,7 @@ tags:
   - Detect Zerologon Attack
   - Cloud Federated Credential Abuse
   - DarkSide Ransomware
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6

detections/endpoint/detect_new_local_admin_account.yml

@@ -22,6 +22,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -28,6 +28,7 @@ tags:
   - HAFNIUM Group
   - Living Off The Land
   - Industroyer2
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/dump_lsass_via_procdump.yml

@@ -1,7 +1,7 @@
 name: Dump LSASS via procdump
 id: 3742ebfe-64c2-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
+version: 3
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -31,10 +31,12 @@ references:
 - https://attack.mitre.org/techniques/T1003/001/
 - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
 tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/extraction_of_registry_hives.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - DarkSide Ransomware
   - Credential Dumping
+  - CISA AA22-257A
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -33,6 +33,7 @@ tags:
   - Living Off The Land
   - Azorult
   - DarkCrystal RAT
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - XMRig
   - Industroyer2
+  - CISA AA22-257A
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/short_lived_scheduled_task.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml

@@ -0,0 +1,92 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
+  AND (like (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR like (cmd_line, "%.xml%"))
+  AND like (cmd_line, "%pcwdiagnostic%")
+  | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+  impact: 100 
+  cve:
+  - CVE-2022-30190
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative of indirect command execution.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 100
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml

@@ -0,0 +1,85 @@
+name: Windows Ingress Tool Transfer Using Explorer
+id: 695bfad6-9662-4f9e-a576-bf02a951aa60
+version: 1
+date: '2022-09-13'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe" 
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints.
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
+references:
+  - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to download an additional payload.
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 25
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -1,7 +1,7 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 3
-date: '2022-07-19'
+version: 4
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
@@ -16,11 +16,11 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
   process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
   process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
   process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
-  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
+  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
   process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 

detections/endpoint/ssa___windows_odbcconf_load_response_file.yml

@@ -0,0 +1,84 @@
+name: Windows Odbcconf Load Response File
+id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
+  AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
+references:
+  - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
+  - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ attempting to circumvent controls.
+  mitre_attack_id:
+  - T1218.008
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 42
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml

@@ -0,0 +1,90 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe"
+  AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  - Living Off The Land
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1003.003
+  - T1003
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 50
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml

@@ -0,0 +1,87 @@
+name: Windows OS Credential Dumping with Procdump
+id: e102e297-dbe6-4a19-b319-5c08f4c19a06
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (original_file_name=procdump) of the
+  PE or look for procdump64.exe. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe" OR process_name="procdump64.exe")
+  AND (like (cmd_line, "%-mm %") OR like (cmd_line, "%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  cis20: []
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

@@ -0,0 +1,82 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+  - https://redcanary.com/blog/introducing-atomictestharnesses/
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$ under user $dest_user_id$.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml

@@ -0,0 +1,94 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+id: 0fec631a-7c9b-4e4c-b28b-93260953e25f
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file from a remote url. This particular technique will load Windows
+  script code from a compiled help file. CHM files may  contain nearly any file type
+  embedded, but only execute html/htm. Upon a successful execution, the following
+  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
+  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
+  upon execution. The "htm" and "html" file extensions were the only extensions observed
+  to be supported for the execution of Shortcut commands or WSH script code. During
+  investigation, identify script content origination. Review reputation of remote
+  IP and domain. Some instances, it is worth decompiling the .chm file to review its
+  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives:  Although unlikely, some legitimate applications may retrieve
+  a CHM remotely, filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://www.kb.cert.org/vuls/id/851869
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+  - https://lolbas-project.github.io/lolbas/Binaries/Hh/
+  - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+  - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ contacting a remote destination.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml

@@ -0,0 +1,96 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers
+id: ba0c2450-caea-4086-ac3a-a71e2659754b
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
+  will load Windows script code from a compiled help file, using InfoTech Storage
+  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
+  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
+  file from within a CHM file. CHM files may contain nearly any file type embedded.
+  Upon a successful execution, the following script engines may be used for execution
+  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
+  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
+  and "html" file extensions were the only extensions observed to be supported for
+  the execution of Shortcut commands or WSH script code. During investigation, identify
+  script content origination. hh.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND (like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
+  used, but it does happen in some legitimate instances. Filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://www.kb.cert.org/vuls/id/851869
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+  - https://lolbas-project.github.io/lolbas/Binaries/Hh/
+  - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+  - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified using Infotech Storage Handlers to load
+    a specific file within a CHM on $dest_device_id$ under user $dest_user_id$.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml

@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+id: 8d1d5570-722c-49a3-996c-2e2cceef5163
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the usage of msiexec.exe using the
+  /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to register a file.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml

@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download
+id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies msiexec.exe with http in the command-line.
+  This procedure will utilize msiexec.exe to download a remote file and load it. During
+  triage, review parallel processes and capture any artifacts on disk for review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+id: df76a8d1-92e1-4ec9-b8f7-695b5838703e
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description:  The following analytic identifies the usage of msiexec.exe using the
+  /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to unregister a DLL.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/w3wp_spawning_shell.yml

@@ -38,6 +38,7 @@ tags:
   - Hermetic Wiper
   - HAFNIUM Group
   - ProxyShell
+  - CISA AA22-257A
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml

@@ -36,7 +36,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: the registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
+  message: The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
   mitre_attack_id:
   - T1547.008
   nist:

detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml

@@ -0,0 +1,60 @@
+name: Windows Event Triggered Image File Execution Options Injection
+id: f7abfab9-12ea-44e8-8745-475f9ca6e0a4
+version: 1
+date: '2022-09-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
+  The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
+  Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
+search: '`wineventlog_application` EventCode=3000 
+  | rename param1 AS "Process" param2 AS "Exit_Code"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_event_triggered_image_file_execution_options_injection_filter`'
+how_to_implement: This analytic requires capturing the Windows Event Log Application channel in XML. 
+known_false_positives: False positives may be present and tuning will be required before turning into a TTP or notable.
+references:
+- https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html
+- https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  message: Windows eventcode 3000 triggered on $dest$ potentially indicating persistence or a monitoring of a process has occurred.
+  mitre_attack_id:
+  - T1546.012
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Process 
+  - Exit_Code 
+  - dest
+  - EventCode
+  risk_score: 25
+  security_domain: endpoint

detections/endpoint/windows_hidden_schedule_task_settings.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Industroyer2
   - Active Directory Discovery
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_identify_protocol_handlers.yml

@@ -1,13 +1,13 @@
 name: Windows Identify Protocol Handlers
 id: bd5c311e-a6ea-48ae-a289-19a3398e3648
-version: 1
-date: '2022-07-11'
+version: 2
+date: '2022-09-13'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
 description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings).
-  To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.'
+  To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes  by Processes.dest Processes.user Processes.process_name Processes.process 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
@@ -17,6 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
 references:
+  - https://gist.github.com/MHaggis/a0d3edb57d36e0916c94c0a464b2722e
   - https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html
   - https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/
   - https://github.com/Mr-Un1k0d3r/PoisonHandler

detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml

@@ -1,16 +1,16 @@
 name: Windows Ingress Tool Transfer Using Explorer
 id: 76753bab-f116-4ea3-8fb9-89b638be58a9
-version: 1
-date: '2022-08-01'
+version: 2
+date: '2022-08-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic detects an explorer.exe with a possible url link process command line on it.
-  Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. 
-  So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application 
-  in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
-  which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*")
   by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
@@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: unknown
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
 references:
 - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
 tags:
@@ -43,16 +43,28 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: a explorer process with url link $process$ in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote payload.
   mitre_attack_id:
   - T1105
   nist:
   - DE.CM
   observable:
+  - name: user
+    type: User
+    role:
+    - Victim
   - name: dest
     type: Hostname
     role:
     - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -71,4 +83,4 @@ tags:
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 25
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/windows_possible_credential_dumping.yml

@@ -44,6 +44,7 @@ tags:
   - Credential Dumping
   - Detect Zerologon Attack
   - DarkSide Ransomware
+  - CISA AA22-257A
   automated_detection_testing: passed
   confidence: 80
   context:

detections/endpoint/windows_protocol_tunneling_with_plink.yml

@@ -0,0 +1,82 @@
+name: Windows Protocol Tunneling with Plink
+id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=plink.exe OR Processes.original_file_name=Plink
+  Processes.process IN ("*-R *", "*-L *", "*-D *", "*-l *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `windows_protocol_tunneling_with_plink_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
+references:
+  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+  - https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
+  - https://attack.mitre.org/techniques/T1572/
+  - https://documentation.help/PuTTY/using-cmdline-portfwd.html#S3.8.3.5
+tags:
+  analytic_story:
+  - CISA AA22-257A
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Command & Control
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination.
+  mitre_attack_id:
+  - T1572
+  - T1021.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

@@ -0,0 +1,80 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_hh`
+  Processes.process=*-decompile* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+  - https://redcanary.com/blog/introducing-atomictestharnesses/
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Delivery
+  message: $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint

detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml

@@ -46,6 +46,7 @@ tags:
   - Windows Persistence Techniques
   - Ransomware
   - Ryuk Ransomware
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -49,6 +49,7 @@ tags:
   - IcedID
   - Active Directory Lateral Movement
   - Industroyer2
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -33,6 +33,7 @@ tags:
   - Windows Persistence Techniques
   - Industroyer2
   - DarkCrystal RAT
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint

detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - CISA AA22-257A
   asset_type: Endpoint
   confidence: 50
   context:

detections/web/log4shell_jndi_payload_injection_attempt.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml

@@ -0,0 +1,74 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
+version: 1
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe" AND
+  (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%")
+  OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%")) AND (like
+  (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR
+  like (cmd_line, "%.xml%")) AND like (cmd_line, "%pcwdiagnostic%") | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
+references:
+- https://isc.sans.edu/diary/rss/28694
+- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 100
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/
+test:
+  name: Windows Execute Arbitrary Commands with MSDT Unit Test
+  tests:
+  - name: Windows Execute Arbitrary Commands with MSDT
+    file: endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: msdt-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml

@@ -0,0 +1,68 @@
+name: Windows Ingress Tool Transfer Using Explorer
+id: 695bfad6-9662-4f9e-a576-bf02a951aa60
+version: 1
+description: The following analytic identifies the Windows Explorer process with a
+  URL within the command-line. Explorer.exe is known Windows process that handles
+  start menu, taskbar, desktop and file manager. Many adversaries abuse this process,
+  like DCRat malware, where it attempts to open the URL with the default browser application
+  on the target host by putting the URL as a parameter on explorer.exe process. This
+  anomaly detection might be a good pivot to check which user and how this process
+  was executed, what is the parent process and what is the URL link. This technique
+  is not commonly used to open an URL.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name,
+  "userinit.exe") OR like(parent_process_name, "svchost.exe")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints.
+known_false_positives: False positives may be present based on legitimate applications
+  or third party utilities. Filter out any additional parent process names.
+references:
+- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 25
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/
+test:
+  name: Windows Ingress Tool Transfer Using Explorer Unit Test
+  tests:
+  - name: Windows Ingress Tool Transfer Using Explorer
+    file: endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: T1105_explorer-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -1,6 +1,6 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 3
+version: 4
 description: The following analytic identifies native living off the land binaries
   within the Windows operating system that may be abused by adversaries by moving
   it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
@@ -14,24 +14,23 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
   $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe"
-  OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe"
-  OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe"
-  OR process_name="certutil.exe" OR process_name="cmdkey.exe" OR process_name="cmdl32.exe"
-  OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe"
-  OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe"
-  OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR process_name="diskshadow.exe"
-  OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe"
-  OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe"
-  OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe"
-  OR process_name="fltmc.exe" OR process_name="forfiles.exe" OR process_name="ftp.exe"
-  OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe"
-  OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe"
-  OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe"
-  OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe"
-  OR process_name="msdt.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
-  OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe"
-  OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR
-  process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
+  OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe"
+  OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
+  OR process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe"
+  OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe"
+  OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe"
+  OR process_name="diantz.exe" OR process_name="diskshadow.exe" OR process_name="dllhost.exe"
+  OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe"
+  OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe"
+  OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe"
+  OR process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe"
+  OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe"
+  OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe"
+  OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe"
+  OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe"
+  OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="netsh.exe"
+  OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe"
+  OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
   OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
   OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"
   OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe"

dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml

@@ -0,0 +1,68 @@
+name: Windows Odbcconf Load Response File
+id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
+version: 1
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
+  AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
+references:
+- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
+- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.008
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 42
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/
+test:
+  name: Windows Odbcconf Load Response File Unit Test
+  tests:
+  - name: Windows Odbcconf Load Response File
+    file: endpoint/ssa___windows_odbcconf_load_response_file.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: odbcconf-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml

@@ -0,0 +1,73 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
+version: 1
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe"
+  AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  - Living Off The Land
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.003
+  - T1003
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 50
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/
+test:
+  name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test
+  tests:
+  - name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+    file: endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml

@@ -0,0 +1,70 @@
+name: Windows OS Credential Dumping with Procdump
+id: e102e297-dbe6-4a19-b319-5c08f4c19a06
+version: 1
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (original_file_name=procdump) of the
+  PE or look for procdump64.exe. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe"
+  OR process_name="procdump64.exe") AND (like (cmd_line, "%-mm %") OR like (cmd_line,
+  "%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/
+test:
+  name: Windows OS Credential Dumping with Procdump Unit Test
+  tests:
+  - name: Windows OS Credential Dumping with Procdump
+    file: endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: procdump_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

@@ -0,0 +1,70 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50
+version: 1
+description: The following analytic identifies the decompile parameter with the HTML
+  Help application, HH.exe. This is a uncommon command to see ran and behavior. Most
+  recently this was seen in a APT41 campaign where a CHM file was delivered and a
+  script inside used a technique for running an arbitrary command in a CHM file via
+  an ActiveX object. This unpacks an HTML help file to a specified path for launching
+  the next stage.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://attack.mitre.org/techniques/T1218/001/
+- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+      source: WinEventLog:Security

dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml

@@ -0,0 +1,79 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+id: 0fec631a-7c9b-4e4c-b28b-93260953e25f
+version: 1
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file from a remote url. This particular technique will load Windows
+  script code from a compiled help file. CHM files may  contain nearly any file type
+  embedded, but only execute html/htm. Upon a successful execution, the following
+  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
+  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
+  upon execution. The "htm" and "html" file extensions were the only extensions observed
+  to be supported for the execution of Shortcut commands or WSH script code. During
+  investigation, identify script content origination. Review reputation of remote
+  IP and domain. Some instances, it is worth decompiling the .chm file to review its
+  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, some legitimate applications may retrieve
+  a CHM remotely, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://www.kb.cert.org/vuls/id/851869
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+    Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File URL In Command
+      Line
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: chm-wineventlog-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+      source: WinEventLog:Security

dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml

@@ -0,0 +1,82 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
+  Handlers
+id: ba0c2450-caea-4086-ac3a-a71e2659754b
+version: 1
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
+  will load Windows script code from a compiled help file, using InfoTech Storage
+  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
+  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
+  file from within a CHM file. CHM files may contain nearly any file type embedded.
+  Upon a successful execution, the following script engines may be used for execution
+  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
+  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
+  and "html" file extensions were the only extensions observed to be supported for
+  the execution of Shortcut commands or WSH script code. During investigation, identify
+  script content origination. hh.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  (like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
+  used, but it does happen in some legitimate instances. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://www.kb.cert.org/vuls/id/851869
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
+    Handlers Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech
+      Storage Handlers
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: chm-wineventlog-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+      source: WinEventLog:Security

dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml

@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+id: 8d1d5570-722c-49a3-996c-2e2cceef5163
+version: 1
+description: The following analytic identifies the usage of msiexec.exe using the
+  /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/
+test:
+  name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml

@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download
+id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5
+version: 1
+description: The following analytic identifies msiexec.exe with http in the command-line.
+  This procedure will utilize msiexec.exe to download a remote file and load it. During
+  triage, review parallel processes and capture any artifacts on disk for review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/
+test:
+  name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec Remote Download
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog

dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+id: df76a8d1-92e1-4ec9-b8f7-695b5838703e
+version: 1
+description: The following analytic identifies the usage of msiexec.exe using the
+  /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/
+test:
+  name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog

macros/wineventlog_application.yml

@@ -0,0 +1,4 @@
+definition: eventtype=wineventlog_application OR source="XmlWinEventLog:Application"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: wineventlog_application

stories/cisa_aa22_257a.yml

@@ -0,0 +1,25 @@
+name: CISA AA22-257A
+id: e1aec96e-bc7d-4edf-8ff7-3da9b7b29147
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+description: The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.
+narrative: This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC.
+  Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations.
+  The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organizations. These actors often operate under the auspices of Najee Technology Hooshmand Fater LLC, based in Karaj, Iran, and Afkar System Yazd Company, based in Yazd, Iran. The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks rather than targeting specific targeted entities or sectors.
+  This advisory provides observed tactics, techniques, and indicators of compromise (IOCs) that the authoring agencies assess are likely associated with this IRGC-affiliated APT. The authoring agencies urge organizations, especially critical infrastructure organizations, to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from these IRGC-affiliated cyber actors.
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/aa21-321a
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-257a
+  - https://www.ic3.gov/Media/News/2021/210527.pdf
+  - https://www.us-cert.gov/sites/default/files/AA22-257A.stix.xml
+  - https://www.us-cert.cisa.gov/iran
+tags:
+  analytic_story: CISA AA22-257A
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml

@@ -0,0 +1,11 @@
+name: Windows Execute Arbitrary Commands with MSDT Unit Test
+tests:
+- name: Windows Execute Arbitrary Commands with MSDT
+  file: endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: msdt-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml

@@ -0,0 +1,11 @@
+name: Windows Ingress Tool Transfer Using Explorer Unit Test
+tests:
+- name: Windows Ingress Tool Transfer Using Explorer
+  file: endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1105_explorer-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml

@@ -0,0 +1,11 @@
+name: Windows Odbcconf Load Response File Unit Test
+tests:
+- name: Windows Odbcconf Load Response File
+  file: endpoint/ssa___windows_odbcconf_load_response_file.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: odbcconf-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml

@@ -0,0 +1,11 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test
+tests:
+- name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+  file: endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml

@@ -0,0 +1,11 @@
+name: Windows OS Credential Dumping with Procdump Unit Test
+tests:
+- name: Windows OS Credential Dumping with Procdump
+  file: endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: procdump_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml

@@ -0,0 +1,10 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+    source: WinEventLog:Security
+    update_timestamp: true

tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml

@@ -0,0 +1,10 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: chm-wineventlog-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+    source: WinEventLog:Security
+    update_timestamp: true

tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml

@@ -0,0 +1,10 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: chm-wineventlog-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+    source: WinEventLog:Security
+    update_timestamp: true

tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml

@@ -0,0 +1,11 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml

@@ -0,0 +1,11 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec Remote Download
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml

@@ -0,0 +1,11 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml

@@ -0,0 +1,13 @@
+name: Windows Event Triggered Image File Execution Options Injection Unit Test
+tests:
+- name: Windows Event Triggered Image File Execution Options Injection
+  file: endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-application.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application.log
+    source: XmlWinEventLog:Application
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

tests/endpoint/windows_protocol_tunneling_with_plink.test.yml

@@ -0,0 +1,13 @@
+name: Windows Protocol Tunneling with Plink Unit Test
+tests:
+- name: Windows Protocol Tunneling with Plink
+  file: endpoint/windows_protocol_tunneling_with_plink.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: plink-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml

@@ -0,0 +1,13 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+  file: endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: hh_decom_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true