removed

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -1,39 +0,0 @@
-name: Delete ShadowCopy With PowerShell
-id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
-version: 1
-date: '2021-05-12'
-author: Teoderick Contreras, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: this search is to detect powershell command to delete shadow copy using wmic powershell module.
-  This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded
-  command to delete shadow copy. This hex encoded command was able to decrypt by powershell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" 
-  stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `delete_shadowcopy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
-tags:
-  analytic_story:
-  - Ransomware
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1490
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - Message
-  - ComputerName
-  - User
-  security_domain: endpoint

detections/endpoint/ransomware_notes_bulk_creation.yml

@@ -1,49 +0,0 @@
-name: Ransomware Notes bulk creation
-id: eff7919a-8330-11eb-83f8-acde48001122
-version: 1
-date: '2021-03-12'
-author: Teoderick Contreras
-type: batch
-datamodel:
-- Endpoint
-description: The following analytics identifies a big number of instance of ransomware
-  notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This
-  behavior is a good sensor if the ransomware note filename is quite new for security
-  industry or the ransomware note filename is not in your lookup table list for monitoring.
-search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time
-  span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename)
-  as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer
-  Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`'
-how_to_implement: You must be ingesting data that records the filesystem activity
-  from your hosts to populate the Endpoint file-system data model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
-tags:
-  analytic_story:
-  - Clop Ransomware
-  - DarkSide Ransomware
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log
-  kill_chain_phases:
-  - Obfuscation
-  mitre_attack_id:
-  - T1486
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - EventCode
-  - file_name
-  - _time
-  - TargetFilename
-  - Computer
-  - Image
-  - user
-  security_domain: endpoint

macros/powershell.yml

@@ -1,4 +0,0 @@
-definition: sourcetype=XmlWinEventLog:Microsoft-Windows-PowerShell/Operational 
-description: customer specific splunk configurations(eg- index, source, sourcetype).
-  Replace the macro definition with configurations for your Splunk Environmnent.
-name: powershell

tests/endpoint/delete_shadowcopy_with_powershell.test.yml

@@ -1,12 +0,0 @@
-name: Delete ShadowCopy With PowerShell Unit Test
-tests:
-- name: Delete ShadowCopy With PowerShell
-  file: endpoint/delete_shadowcopy_with_powershell.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log
-    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog