Merge branch 'develop' into joinopolis

bin/contentctl_project/contentctl_core/application/factory/new_content_factory.py

@@ -63,6 +63,7 @@ class NewContentFactory():
             if answers['detection_product'] == 'SSA':
                 self.output_dto.obj['tags']['product'] = ['Splunk Behavioral Analytics']
             self.output_dto.obj['tags']['risk_score'] = 'UPDATE (impact * confidence)/100'
+            self.output_dto.obj['tags']['required_fields'] = ['UPDATE_required_fields']
             self.output_dto.obj['tags']['security_domain'] = answers['security_domain']
             self.output_dto.obj['source'] = answers['detection_kind']
             self.output_dto.obj['tests'] = list()

bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py

@@ -73,6 +73,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
 
             if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'):
                 for entity in self.security_content_obj.tags.observable:
+
                     risk_object = dict()
                     if entity['type'].lower() in risk_object_user_types:
                         risk_object['risk_object_type'] = 'user'
@@ -85,9 +86,15 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
                         risk_object['risk_object_field'] = entity['name']
                         risk_object['risk_score'] = self.security_content_obj.tags.risk_score
                         risk_objects.append(risk_object)
-                    else:
+
+                    elif 'role' in entity and 'Attacker' in entity['role']:
                         risk_object['threat_object_field'] = entity['name']
                         risk_object['threat_object_type'] = entity['type'].lower()
+                        risk_objects.append(risk_object) 
+                    else:
+                        risk_object['risk_object_type'] = 'other'
+                        risk_object['risk_object_field'] = entity['name']
+                        risk_object['risk_score'] = self.security_content_obj.tags.risk_score
                         risk_objects.append(risk_object)
                         continue
 

detections/application/email_attachments_with_lots_of_spaces.yml

@@ -1,7 +1,7 @@
 name: Email Attachments With Lots Of Spaces
 id: 56e877a6-1455-4479-ada6-0550dc1e22f8
 version: 2
-date: '2017-09-19'
+date: '2023-04-14'
 author: David Dorsey, Splunk
 status: experimental
 type: Anomaly
@@ -32,8 +32,9 @@ known_false_positives: None at this time
 references: []
 tags:
   analytic_story:
-  - Hermetic Wiper
+  - Data Destruction
   - 'Emotet Malware  DHS Report TA18-201A '
+  - Hermetic Wiper
   - Suspicious Emails
   asset_type: Endpoint
   confidence: 50

detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml

@@ -27,7 +27,11 @@ tags:
   - T1078
   - T1078.001
   - T1110.004
-  observable: []
+  observable:
+  - name: outcome.reason
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/application/okta_threatinsight_suspected_passwordspray_attack.yml

@@ -27,7 +27,11 @@ tags:
   - T1078
   - T1078.001
   - T1110.003
-  observable: []
+  observable:
+  - name: outcome.reason
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/application/suspicious_email_attachment_extensions.yml

@@ -1,7 +1,7 @@
 name: Suspicious Email Attachment Extensions
 id: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084
 version: 3
-date: '2020-07-22'
+date: '2023-04-14'
 author: David Dorsey, Splunk
 status: experimental
 type: Anomaly
@@ -29,8 +29,9 @@ known_false_positives: None identified
 references: []
 tags:
   analytic_story:
-  - Hermetic Wiper
+  - Data Destruction
   - 'Emotet Malware  DHS Report TA18-201A '
+  - Hermetic Wiper
   - Suspicious Emails
   asset_type: Endpoint
   confidence: 50

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -42,8 +42,8 @@ tags:
     type: Other
     role:
     - Attacker
-  - name: requestedAccountId
-    type: Other
+  - name: user
+    type: User
     role:
     - Victim
   product:

detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml

@@ -56,10 +56,10 @@ tags:
   - src_ip
   risk_score: 54
   security_domain: threat
+  manual_test: This search needs a specific number of events in a time window for the alert to trigger and events split up in CI testing while updating timestamp.
 tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
     source: aws_cloudtrail
     sourcetype: aws:cloudtrail
-    update_timestamp: true

detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml

@@ -77,6 +77,7 @@ tags:
   - All_Changes.command
   risk_score: 18
   security_domain: threat
+  manual_test: This search needs the baseline to be run first to create a lookup
 tests:
 - name: True Positive Test
   attack_data:

detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml

@@ -77,6 +77,7 @@ tags:
   - All_Changes.command
   risk_score: 42
   security_domain: threat
+  manual_test: This search needs the baseline to be run first to create a lookup
 tests:
 - name: True Positive Test
   attack_data:

detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml

@@ -76,6 +76,7 @@ tags:
   - All_Changes.command
   risk_score: 42
   security_domain: threat
+  manual_test: This search needs the baseline to be run first to create a lookup
 tests:
 - name: True Positive Test
   attack_data:

detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml

@@ -77,6 +77,7 @@ tags:
   - All_Changes.command
   risk_score: 42
   security_domain: threat
+  manual_test: This search needs the baseline to be run first to create a lookup
 tests:
 - name: True Positive Test
   attack_data:

detections/endpoint/active_setup_registry_autostart.yml

@@ -1,7 +1,7 @@
 name: Active Setup Registry Autostart
 id: f64579c0-203f-11ec-abcc-acde48001122
 version: 4
-date: '2023-03-29'
+date: '2023-04-27'
 author: Steven Dick, Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -28,9 +28,10 @@ references:
 - https://attack.mitre.org/techniques/T1547/014/
 tags:
   analytic_story:
-  - Windows Persistence Techniques
+  - Data Destruction
   - Windows Privilege Escalation
   - Hermetic Wiper
+  - Windows Persistence Techniques
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/add_or_set_windows_defender_exclusion.yml

@@ -1,7 +1,7 @@
 name: Add or Set Windows Defender Exclusion
 id: 773b66fe-4dd9-11ec-8289-acde48001122
 version: 1
-date: '2021-11-25'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -32,11 +32,12 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
-  - Remcos
-  - Windows Defense Evasion Tactics
-  - WhisperGate
   - CISA AA22-320A
   - AgentTesla
+  - Remcos
+  - Windows Defense Evasion Tactics
+  - Data Destruction
+  - WhisperGate
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/adsisearcher_account_discovery.yml

@@ -1,7 +1,7 @@
 name: AdsiSearcher Account Discovery
 id: de7fcadc-04f3-11ec-a241-acde48001122
 version: 2
-date: '2022-11-13'
+date: '2023-04-14'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -25,8 +25,9 @@ references:
 - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
 tags:
   analytic_story:
-  - Industroyer2
+  - Data Destruction
   - Active Directory Discovery
+  - Industroyer2
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/any_powershell_downloadfile.yml

@@ -1,7 +1,7 @@
 name: Any Powershell DownloadFile
 id: 1a93b7ea-7af7-11eb-adb5-acde48001122
 version: 3
-date: '2022-04-07'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -32,11 +32,12 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
 tags:
   analytic_story:
+  - DarkCrystal RAT
+  - Ingress Tool Transfer
   - Hermetic Wiper
   - Malicious PowerShell
-  - Ingress Tool Transfer
+  - Data Destruction
   - Log4Shell CVE-2021-44228
-  - DarkCrystal RAT
   asset_type: Endpoint
   confidence: 70
   cve:

detections/endpoint/attempt_to_stop_security_service.yml

@@ -1,7 +1,7 @@
 name: Attempt To Stop Security Service
 id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
 version: 4
-date: '2020-07-21'
+date: '2023-04-14'
 author: Rico Valdez, Splunk
 status: production
 type: TTP
@@ -29,10 +29,11 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
-  - Disabling Security Tools
-  - Trickbot
-  - WhisperGate
   - Azorult
+  - Trickbot
+  - Disabling Security Tools
+  - Data Destruction
+  - WhisperGate
   asset_type: Endpoint
   confidence: 50
   impact: 40

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -1,7 +1,7 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
 version: 7
-date: '2022-11-15'
+date: '2023-04-14'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
@@ -28,10 +28,11 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   analytic_story:
+  - Industroyer2
+  - Windows Registry Abuse
   - Credential Dumping
   - DarkSide Ransomware
-  - Windows Registry Abuse
-  - Industroyer2
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 90

detections/endpoint/change_default_file_association.yml

@@ -1,7 +1,7 @@
 name: Change Default File Association
 id: 462d17d8-1f71-11ec-ad07-acde48001122
 version: 1
-date: '2021-09-27'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -29,11 +29,12 @@ references:
 - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - Windows Privilege Escalation
-  - Windows Registry Abuse
   - Hermetic Wiper
+  - Windows Registry Abuse
   - Prestige Ransomware
+  - Windows Privilege Escalation
+  - Windows Persistence Techniques
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/child_processes_of_spoolsv_exe.yml

@@ -1,7 +1,7 @@
 name: Child Processes of Spoolsv exe
 id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df
 version: 3
-date: '2020-03-16'
+date: '2023-04-14'
 author: Rico Valdez, Splunk
 status: experimental
 type: TTP
@@ -28,8 +28,9 @@ known_false_positives: Some legitimate printer-related processes may show up as
 references: []
 tags:
   analytic_story:
-  - Windows Privilege Escalation
+  - Data Destruction
   - Hermetic Wiper
+  - Windows Privilege Escalation
   asset_type: Endpoint
   confidence: 50
   cve:

detections/endpoint/detect_empire_with_powershell_script_block_logging.yml

@@ -1,7 +1,7 @@
 name: Detect Empire with PowerShell Script Block Logging
 id: bc1dc6b8-c954-11eb-bade-acde48001122
 version: 2
-date: '2022-02-24'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -40,8 +40,9 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 90
   impact: 90

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -35,6 +35,7 @@ tags:
   - CISA AA22-257A
   - CISA AA22-264A
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: Windows
   confidence: 80
   impact: 80

detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml

@@ -41,6 +41,8 @@ tags:
   - Malicious PowerShell
   - CISA AA22-264A
   - CISA AA22-320A
+  - Sandworm Tools
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 90

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -39,6 +39,7 @@ tags:
   - DarkSide Ransomware
   - Active Directory Lateral Movement
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/detect_renamed_psexec.yml

@@ -37,6 +37,7 @@ tags:
   - DarkSide Ransomware
   - Active Directory Lateral Movement
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 90
   impact: 30

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -32,11 +32,12 @@ references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
-  - Windows Defense Evasion Tactics
-  - Ransomware
-  - Revil Ransomware
-  - Windows Registry Abuse
   - Azorult
+  - Windows Registry Abuse
+  - Revil Ransomware
+  - RedLine Stealer
+  - Ransomware
+  - Windows Defense Evasion Tactics
   asset_type: Endpoint
   confidence: 100
   impact: 40
@@ -55,15 +56,6 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.user
-  - Processes.dest
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_path
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_guid
   - Registry.dest
   - Registry.registry_value_name
   - Registry.registry_key_name

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -1,7 +1,7 @@
 name: Dump LSASS via comsvcs DLL
 id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
 version: 2
-date: '2020-02-21'
+date: '2023-04-14'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
@@ -24,14 +24,15 @@ references:
 - https://twitter.com/SBousseaden/status/1167417096374050817
 tags:
   analytic_story:
-  - Credential Dumping
-  - Suspicious Rundll32 Activity
-  - HAFNIUM Group
-  - Living Off The Land
   - Industroyer2
-  - CISA AA22-257A
+  - HAFNIUM Group
   - CISA AA22-264A
   - Prestige Ransomware
+  - Credential Dumping
+  - CISA AA22-257A
+  - Living Off The Land
+  - Suspicious Rundll32 Activity
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/etw_registry_disabled.yml

@@ -25,10 +25,11 @@ references:
 - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - Windows Privilege Escalation
-  - Windows Registry Abuse
   - Hermetic Wiper
+  - Windows Privilege Escalation
+  - Windows Persistence Techniques
+  - Windows Registry Abuse
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 90

detections/endpoint/excessive_file_deletion_in_windefender_folder.yml

@@ -1,7 +1,7 @@
 name: Excessive File Deletion In WinDefender Folder
 id: b5baa09a-7a05-11ec-8da4-acde48001122
 version: 1
-date: '2022-01-20'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -27,6 +27,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Data Destruction
   - WhisperGate
   asset_type: Endpoint
   confidence: 50

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -1,7 +1,7 @@
 name: Executable File Written in Administrative SMB Share
 id: f63c34fe-a435-11eb-935a-acde48001122
 version: 2
-date: '2021-11-18'
+date: '2023-04-14'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -32,12 +32,12 @@ references:
 - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
 tags:
   analytic_story:
-  - Data Destruction
-  - Active Directory Lateral Movement
-  - Trickbot
-  - Hermetic Wiper
   - Industroyer2
+  - Active Directory Lateral Movement
+  - Hermetic Wiper
+  - Trickbot
   - Prestige Ransomware
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 70

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -1,7 +1,7 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
 version: 1
-date: '2021-10-06'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -37,24 +37,25 @@ references:
 - https://twitter.com/pr0xylife/status/1590394227758104576
 tags:
   analytic_story:
-  - Double Zero Destructor
-  - Data Destruction
-  - XMRig
-  - Remcos
-  - WhisperGate
-  - Hermetic Wiper
-  - Industroyer2
   - Azorult
-  - DarkCrystal RAT
-  - Brute Ratel C4
-  - AgentTesla
-  - Qakbot
-  - IcedID
-  - Trickbot
-  - Chaos Ransomware
-  - LockBit Ransomware
   - AsyncRAT
+  - XMRig
   - Swift Slicer
+  - DarkCrystal RAT
+  - Double Zero Destructor
+  - Trickbot
+  - Data Destruction
+  - LockBit Ransomware
+  - Industroyer2
+  - Remcos
+  - RedLine Stealer
+  - WhisperGate
+  - IcedID
+  - Hermetic Wiper
+  - AgentTesla
+  - Brute Ratel C4
+  - Qakbot
+  - Chaos Ransomware
   asset_type: Endpoint
   confidence: 50
   impact: 40

detections/endpoint/icacls_deny_command.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - XMRig
   - Azorult
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 80
   impact: 90

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -1,7 +1,7 @@
 name: Impacket Lateral Movement Commandline Parameters
 id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
 version: 3
-date: '2023-02-24'
+date: '2023-04-14'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -15,11 +15,12 @@ description: This analytic looks for the presence of suspicious commandline para
   tools for lateral movement and remote code execution.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2>&1*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `impacket_lateral_movement_commandline_parameters_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
+  (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2>&1*"))
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
@@ -37,11 +38,12 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
-  - Active Directory Lateral Movement
-  - WhisperGate
   - Industroyer2
-  - CISA AA22-277A
+  - Active Directory Lateral Movement
   - Prestige Ransomware
+  - CISA AA22-277A
+  - Data Destruction
+  - WhisperGate
   asset_type: Endpoint
   confidence: 70
   impact: 90

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -1,7 +1,7 @@
 name: Kerberoasting spn request with RC4 encryption
 id: 5cc67381-44fa-4111-8a37-7a230943f027
 version: 4
-date: '2022-02-09'
+date: '2023-04-14'
 author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -30,9 +30,10 @@ references:
 - https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-kerberoasting-activity
 tags:
   analytic_story:
+  - Data Destruction
+  - Hermetic Wiper
   - Windows Privilege Escalation
   - Active Directory Kerberos Attacks
-  - Hermetic Wiper
   asset_type: Endpoint
   confidence: 80
   impact: 90

detections/endpoint/linux_adding_crontab_using_list_parameter.yml

@@ -1,7 +1,7 @@
 name: Linux Adding Crontab Using List Parameter
 id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58
 version: 1
-date: '2022-04-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -31,8 +31,9 @@ tags:
   analytic_story:
   - Industroyer2
   - Linux Privilege Escalation
-  - Linux Persistence Techniques
   - Linux Living Off The Land
+  - Data Destruction
+  - Linux Persistence Techniques
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/linux_data_destruction_command.yml

@@ -1,7 +1,7 @@
 name: Linux Data Destruction Command
 id: b11d3979-b2f7-411b-bb1a-bd00e642173b
 version: 1
-date: '2023-02-08'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - AwfulShred
+  - Data Destruction
   asset_type: Endpoint
   confidence: 90
   impact: 100

detections/endpoint/linux_dd_file_overwrite.yml

@@ -1,7 +1,7 @@
 name: Linux DD File Overwrite
 id: 9b6aae5e-8d85-11ec-b2ae-acde48001122
 version: 1
-date: '2022-02-14'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP

detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml

@@ -1,7 +1,7 @@
 name: Linux Deleting Critical Directory Using RM Command
 id: 33f89303-cc6f-49ad-921d-2eaea38a6f7a
 version: 1
-date: '2022-04-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -31,9 +31,9 @@ references:
 - https://cert.gov.ua/article/39518
 tags:
   analytic_story:
-  - Industroyer2
-  - Data Destruction
   - AwfulShred
+  - Data Destruction
+  - Industroyer2
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/linux_deletion_of_cron_jobs.yml

@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - AcidRain
+  - Data Destruction
   asset_type: endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_deletion_of_init_daemon_script.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - AcidRain
+  - Data Destruction
   asset_type: endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_deletion_of_services.yml

@@ -33,8 +33,9 @@ references:
 - https://cert.gov.ua/article/3718487
 tags:
   analytic_story:
-  - AcidRain
   - AwfulShred
+  - AcidRain
+  - Data Destruction
   asset_type: endpoint
   confidence: 80
   impact: 80

detections/endpoint/linux_disable_services.yml

@@ -1,7 +1,7 @@
 name: Linux Disable Services
 id: f2e08a38-6689-4df4-ad8c-b51c16262316
 version: 1
-date: '2022-04-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -29,8 +29,9 @@ references:
 - https://cert.gov.ua/article/39518
 tags:
   analytic_story:
-  - Industroyer2
   - AwfulShred
+  - Data Destruction
+  - Industroyer2
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_hardware_addition_swapoff.yml

@@ -1,7 +1,7 @@
 name: Linux Hardware Addition SwapOff
 id: c1eea697-99ed-44c2-9b70-d8935464c499
 version: 1
-date: '2023-02-08'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - AwfulShred
+  - Data Destruction
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml

@@ -31,8 +31,8 @@ references:
 - https://cert.gov.ua/article/39518
 tags:
   analytic_story:
-  - Industroyer2
   - Data Destruction
+  - Industroyer2
   asset_type: endpoint
   confidence: 80
   impact: 100

detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml

@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - AcidRain
+  - Data Destruction
   asset_type: endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_impair_defenses_process_kill.yml

@@ -1,7 +1,7 @@
 name: Linux Impair Defenses Process Kill
 id: 435c6b33-adf9-47fe-be87-8e29fd6654f5
 version: 1
-date: '2023-02-08'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - AwfulShred
+  - Data Destruction
   asset_type: Endpoint
   confidence: 30
   impact: 30

detections/endpoint/linux_indicator_removal_clear_cache.yml

@@ -1,7 +1,7 @@
 name: Linux Indicator Removal Clear Cache
 id: e0940505-0b73-4719-84e6-cb94c44a5245
 version: 1
-date: '2023-02-09'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - AwfulShred
+  - Data Destruction
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_indicator_removal_service_file_deletion.yml

@@ -1,7 +1,7 @@
 name: Linux Indicator Removal Service File Deletion
 id: 6c077f81-2a83-4537-afbc-0e62e3215d55
 version: 1
-date: '2023-02-08'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - AwfulShred
+  - Data Destruction
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/linux_iptables_firewall_modification.yml

@@ -1,10 +1,12 @@
 name: Linux Iptables Firewall Modification
 id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7
 version: 3
-date: '2022-06-03'
+date: '2023-04-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
+datamodel:
+- Endpoint
 description: This analytic looks for suspicious commandline that modify the iptables
   firewall setting of a linux machine. This technique was seen in cyclopsblink malware
   where it modifies the firewall setting of the compromised machine to allow traffic
@@ -35,6 +37,7 @@ references:
 - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
 tags:
   analytic_story:
+  - Sandworm Tools
   - CyclopsBLink
   asset_type: Endpoint
   confidence: 50

detections/endpoint/linux_java_spawning_shell.yml

@@ -1,7 +1,7 @@
 name: Linux Java Spawning Shell
 id: 7b09db8a-5c20-11ec-9945-acde48001122
 version: 1
-date: '2021-12-13'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -31,9 +31,10 @@ references:
 - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
 tags:
   analytic_story:
+  - Data Destruction
+  - Spring4Shell CVE-2022-22965
   - Hermetic Wiper
   - Log4Shell CVE-2021-44228
-  - Spring4Shell CVE-2022-22965
   asset_type: Endpoint
   confidence: 50
   cve:

detections/endpoint/linux_kworker_process_in_writable_process_path.yml

@@ -1,10 +1,12 @@
 name: Linux Kworker Process In Writable Process Path
 id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed
 version: 2
-date: '2022-04-30'
+date: '2023-04-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
+datamodel:
+- Endpoint
 description: This analytic looks for suspicious process kworker commandline in a linux
   machine. kworker process name or thread are common names of kernel threads in linux
   process. This hunting detections can lead to investigate process contains process
@@ -32,6 +34,7 @@ references:
 - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
 tags:
   analytic_story:
+  - Sandworm Tools
   - CyclopsBLink
   asset_type: Endpoint
   confidence: 60

detections/endpoint/linux_service_restarted.yml

@@ -1,7 +1,7 @@
 name: Linux Service Restarted
 id: 084275ba-61b8-11ec-8d64-acde48001122
 version: 1
-date: '2021-12-20'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -33,10 +33,11 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Linux Persistence Techniques
-  - Linux Living Off The Land
   - AwfulShred
+  - Linux Privilege Escalation
+  - Linux Living Off The Land
+  - Data Destruction
+  - Linux Persistence Techniques
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/linux_shred_overwrite_command.yml

@@ -1,7 +1,7 @@
 name: Linux Shred Overwrite Command
 id: c1952cf1-643c-4965-82de-11c067cbae76
 version: 1
-date: '2022-04-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -32,9 +32,10 @@ references:
 tags:
   analytic_story:
   - Industroyer2
-  - Linux Privilege Escalation
-  - Linux Persistence Techniques
   - AwfulShred
+  - Linux Privilege Escalation
+  - Data Destruction
+  - Linux Persistence Techniques
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml

@@ -1,7 +1,7 @@
 name: Linux Stdout Redirection To Dev Null File
 id: de62b809-a04d-46b5-9a15-8298d330f0c8
 version: 1
-date: '2022-04-05'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: experimental
 type: Anomaly
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - CyclopsBLink
+  - Data Destruction
   - Industroyer2
   asset_type: Endpoint
   confidence: 60

detections/endpoint/linux_stop_services.yml

@@ -1,7 +1,7 @@
 name: Linux Stop Services
 id: d05204a5-9f1c-4946-a7f3-4fa58d76d5fd
 version: 1
-date: '2022-04-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -29,8 +29,9 @@ references:
 - https://cert.gov.ua/article/39518
 tags:
   analytic_story:
-  - Industroyer2
   - AwfulShred
+  - Data Destruction
+  - Industroyer2
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_system_network_discovery.yml

@@ -1,7 +1,7 @@
 name: Linux System Network Discovery
 id: 535cb214-8b47-11ec-a2c7-acde48001122
 version: 1
-date: '2022-02-11'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -30,6 +30,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
 tags:
   analytic_story:
+  - Data Destruction
   - Network Discovery
   - Industroyer2
   asset_type: endpoint

detections/endpoint/linux_system_reboot_via_system_request_key.yml

@@ -1,7 +1,7 @@
 name: Linux System Reboot Via System Request Key
 id: e1912b58-ed9c-422c-bbb0-2dbc70398345
 version: 1
-date: '2023-02-08'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - AwfulShred
+  - Data Destruction
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml

@@ -1,7 +1,7 @@
 name: Linux Unix Shell Enable All SysRq Functions
 id: e7a96937-3b58-4962-8dce-538e4763cf15
 version: 1
-date: '2023-02-08'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - AwfulShred
+  - Data Destruction
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/local_account_discovery_with_net.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 50
   impact: 30

detections/endpoint/logon_script_event_trigger_execution.yml

@@ -1,7 +1,7 @@
 name: Logon Script Event Trigger Execution
 id: 4c38c264-1f74-11ec-b5fa-acde48001122
 version: 1
-date: '2021-09-27'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -27,9 +27,10 @@ references:
 - https://attack.mitre.org/techniques/T1037/001/
 tags:
   analytic_story:
-  - Windows Persistence Techniques
+  - Data Destruction
   - Windows Privilege Escalation
   - Hermetic Wiper
+  - Windows Persistence Techniques
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -48,6 +48,8 @@ tags:
   - DarkCrystal RAT
   - Qakbot
   - CISA AA22-320A
+  - Sandworm Tools
+  - Data Destruction
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml

@@ -1,7 +1,7 @@
 name: Malicious PowerShell Process With Obfuscation Techniques
 id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4
 version: 5
-date: '2021-01-19'
+date: '2023-04-14'
 author: David Dorsey, Splunk
 status: production
 type: TTP
@@ -27,8 +27,9 @@ known_false_positives: These characters might be legitimately on the command-lin
 references: []
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 60
   impact: 70

detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml

@@ -32,6 +32,7 @@ tags:
   analytic_story:
   - Active Directory Kerberos Attacks
   - CISA AA22-320A
+  - Sandworm Tools
   asset_type: endpoint
   confidence: 60
   impact: 60

detections/endpoint/msi_module_loaded_by_non_system_binary.yml

@@ -1,7 +1,7 @@
 name: MSI Module Loaded by Non-System Binary
 id: ccb98a66-5851-11ec-b91c-acde48001122
 version: 1
-date: '2021-12-08'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -40,8 +40,9 @@ references:
 - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/msi.dll%20Hijack%20(Methodology).ioc
 tags:
   analytic_story:
-  - Windows Privilege Escalation
+  - Data Destruction
   - Hermetic Wiper
+  - Windows Privilege Escalation
   asset_type: Endpoint
   confidence: 70
   cve:

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -1,7 +1,7 @@
 name: Non Chrome Process Accessing Chrome Default Dir
 id: 81263de4-160a-11ec-944f-acde48001122
 version: 1
-date: '2021-09-15'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -11,8 +11,8 @@ description: This search is to detect an anomaly event of a non-chrome process a
   the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
   to collect information on the compromised host. This SACL Event (4663) need to be
   enabled to tthe firefox profile directory to be eable to use this. Since you monitoring
-  this access to the folder,  we observed noise that needs to be filter out and hence added
-  sqlite db browser and explorer .exe to make this detection more stable.
+  this access to the folder,  we observed noise that needs to be filter out and hence
+  added sqlite db browser and explorer .exe to make this detection more stable.
 data_source:
 - Windows Security 4663
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe",
@@ -28,10 +28,11 @@ known_false_positives: other browser not listed related to firefox may catch by
 references: []
 tags:
   analytic_story:
-  - FIN7
   - Remcos
-  - AgentTesla
   - 3CX Supply Chain Attack
+  - AgentTesla
+  - RedLine Stealer
+  - FIN7
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -1,18 +1,18 @@
 name: Non Firefox Process Access Firefox Profile Dir
 id: e6fc13b0-1609-11ec-b533-acde48001122
 version: 1
-date: '2021-09-15'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 description: This search is to detect an anomaly event of a non-firefox process accessing
-  the files in the profile folder. This folder contains all the sqlite database of the
-  firefox browser related to users login, history, cookies and etc. Most of the RAT,
-  trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect
-  information on the compromised host. This SACL Event (4663) needs to be enabled to
-  the firefox profile directory to use this. Since this is monitoring the
-  access to the folder, we have obsevered noise and hence added `sqlite
-  db browser` and `explorer.exe` to make this detection more stable.
+  the files in the profile folder. This folder contains all the sqlite database of
+  the firefox browser related to users login, history, cookies and etc. Most of the
+  RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
+  to collect information on the compromised host. This SACL Event (4663) needs to
+  be enabled to the firefox profile directory to use this. Since this is monitoring
+  the access to the folder, we have obsevered noise and hence added `sqlite db browser`
+  and `explorer.exe` to make this detection more stable.
 data_source:
 - Windows Security 4663
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe",
@@ -28,11 +28,12 @@ known_false_positives: other browser not listed related to firefox may catch by
 references: []
 tags:
   analytic_story:
-  - FIN7
-  - Remcos
   - Azorult
-  - AgentTesla
+  - Remcos
   - 3CX Supply Chain Attack
+  - AgentTesla
+  - RedLine Stealer
+  - FIN7
   asset_type: Endpoint
   confidence: 70
   impact: 50

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -1,7 +1,7 @@
 name: Overwriting Accessibility Binaries
 id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae
 version: 4
-date: '2020-07-21'
+date: '2023-04-14'
 author: David Dorsey, Splunk
 status: production
 type: TTP
@@ -28,8 +28,9 @@ known_false_positives: Microsoft may provide updates to these binaries. Verify t
 references: []
 tags:
   analytic_story:
-  - Windows Privilege Escalation
+  - Data Destruction
   - Hermetic Wiper
+  - Windows Privilege Escalation
   asset_type: Endpoint
   confidence: 90
   impact: 80

detections/endpoint/permission_modification_using_takeown_app.yml

@@ -27,6 +27,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/ping_sleep_batch_command.yml

@@ -1,7 +1,7 @@
 name: Ping Sleep Batch Command
 id: ce058d6c-79f2-11ec-b476-acde48001122
 version: 1
-date: '2022-01-20'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -31,6 +31,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Data Destruction
   - WhisperGate
   asset_type: Endpoint
   confidence: 60

detections/endpoint/possible_lateral_movement_powershell_spawn.yml

@@ -1,7 +1,7 @@
 name: Possible Lateral Movement PowerShell Spawn
 id: cb909b3e-512b-11ec-aa31-3e22fbd008af
 version: 1
-date: '2021-11-29'
+date: '2023-04-14'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -38,9 +38,10 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Active Directory Lateral Movement
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 50
   impact: 90

detections/endpoint/powershell_4104_hunting.yml

@@ -1,7 +1,7 @@
 name: PowerShell 4104 Hunting
 id: d6f2b006-0041-11ec-8885-acde48001122
 version: 3
-date: '2022-05-02'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -54,8 +54,9 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml

@@ -1,7 +1,7 @@
 name: PowerShell - Connect To Internet With Hidden Window
 id: ee18ed37-0802-4268-9435-b3b91aaa18db
 version: 8
-date: '2022-01-12'
+date: '2023-04-14'
 author: David Dorsey, Michael Haag Splunk
 status: production
 type: Hunting
@@ -37,12 +37,13 @@ references:
 - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
 tags:
   analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
-  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
-  - HAFNIUM Group
-  - Log4Shell CVE-2021-44228
   - AgentTesla
+  - HAFNIUM Group
+  - Hermetic Wiper
+  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - Malicious PowerShell
+  - Data Destruction
+  - Log4Shell CVE-2021-44228
   asset_type: Endpoint
   confidence: 90
   cve:

detections/endpoint/powershell_domain_enumeration.yml

@@ -1,7 +1,7 @@
 name: PowerShell Domain Enumeration
 id: e1866ce2-ca22-11eb-8e44-acde48001122
 version: 2
-date: '2022-02-25'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -35,8 +35,9 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 70
   impact: 60

detections/endpoint/powershell_enable_smb1protocol_feature.yml

@@ -1,7 +1,7 @@
 name: Powershell Enable SMB1Protocol Feature
 id: afed80b2-d34b-11eb-a952-acde48001122
 version: 2
-date: '2022-02-25'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -24,9 +24,10 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
   - Ransomware
+  - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/powershell_execute_com_object.yml

@@ -1,7 +1,7 @@
 name: Powershell Execute COM Object
 id: 65711630-f9bf-11eb-8d72-acde48001122
 version: 2
-date: '2022-03-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -26,9 +26,10 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
   - Ransomware
+  - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 50
   impact: 10

detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml

@@ -1,7 +1,7 @@
 name: Powershell Fileless Process Injection via GetProcAddress
 id: a26d9db4-c883-11eb-9d75-acde48001122
 version: 2
-date: '2022-02-25'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -39,8 +39,9 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 60

detections/endpoint/powershell_processing_stream_of_data.yml

@@ -1,7 +1,7 @@
 name: Powershell Processing Stream Of Data
 id: 0d718b52-c9f1-11eb-bc61-acde48001122
 version: 2
-date: '2022-02-25'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -30,9 +30,10 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
   - AsyncRAT
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 50

detections/endpoint/powershell_remove_windows_defender_directory.yml

@@ -1,7 +1,7 @@
 name: Powershell Remove Windows Defender Directory
 id: adf47620-79fa-11ec-b248-acde48001122
 version: 3
-date: '2022-05-02'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -24,6 +24,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Data Destruction
   - WhisperGate
   asset_type: Endpoint
   confidence: 90

detections/endpoint/powershell_using_memory_as_backing_store.yml

@@ -1,7 +1,7 @@
 name: Powershell Using memory As Backing Store
 id: c396a0c4-c9f2-11eb-b4f5-acde48001122
 version: 2
-date: '2022-03-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -29,8 +29,9 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 50

detections/endpoint/powershell_windows_defender_exclusion_commands.yml

@@ -1,7 +1,7 @@
 name: Powershell Windows Defender Exclusion Commands
 id: 907ac95c-4dd9-11ec-ba2c-acde48001122
 version: 1
-date: '2021-11-25'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -28,11 +28,12 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
-  - Remcos
-  - Windows Defense Evasion Tactics
-  - WhisperGate
   - CISA AA22-320A
   - AgentTesla
+  - Remcos
+  - Windows Defense Evasion Tactics
+  - Data Destruction
+  - WhisperGate
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/print_processor_registry_autostart.yml

@@ -1,7 +1,7 @@
 name: Print Processor Registry Autostart
 id: 1f5b68aa-2037-11ec-898e-acde48001122
 version: 1
-date: '2021-09-28'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: experimental
 type: TTP
@@ -31,9 +31,10 @@ references:
 - https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
 tags:
   analytic_story:
-  - Windows Persistence Techniques
+  - Data Destruction
   - Windows Privilege Escalation
   - Hermetic Wiper
+  - Windows Persistence Techniques
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/process_deleting_its_process_file_path.yml

@@ -1,7 +1,7 @@
 name: Process Deleting Its Process File Path
 id: f7eda4bc-871c-11eb-b110-acde48001122
 version: 2
-date: '2022-02-18'
+date: '2023-04-14'
 author: Teoderick Contreras
 status: production
 type: TTP
@@ -31,8 +31,9 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
-  - Remcos
+  - Data Destruction
   - WhisperGate
+  - Remcos
   asset_type: Endpoint
   confidence: 100
   impact: 60

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -1,7 +1,7 @@
 name: Recon AVProduct Through Pwh or WMI
 id: 28077620-c9f6-11eb-8785-acde48001122
 version: 2
-date: '2022-03-22'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -31,12 +31,13 @@ references:
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
-  - Hermetic Wiper
-  - Ransomware
-  - Malicious PowerShell
   - Qakbot
   - Windows Post-Exploitation
+  - Hermetic Wiper
+  - Ransomware
   - Prestige Ransomware
+  - Malicious PowerShell
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/recon_using_wmi_class.yml

@@ -1,7 +1,7 @@
 name: Recon Using WMI Class
 id: 018c1972-ca07-11eb-9473-acde48001122
 version: 2
-date: '2022-10-10'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -36,12 +36,13 @@ references:
 - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
 tags:
   analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
-  - Industroyer2
-  - Qakbot
-  - LockBit Ransomware
   - AsyncRAT
+  - Qakbot
+  - Industroyer2
+  - Hermetic Wiper
+  - LockBit Ransomware
+  - Malicious PowerShell
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 75

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -27,11 +27,12 @@ references:
 - https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/
 tags:
   analytic_story:
-  - Windows Privilege Escalation
-  - Suspicious Windows Registry Activities
   - Cloud Federated Credential Abuse
-  - Windows Registry Abuse
   - Hermetic Wiper
+  - Windows Privilege Escalation
+  - Windows Registry Abuse
+  - Data Destruction
+  - Suspicious Windows Registry Activities
   asset_type: Endpoint
   confidence: 95
   impact: 80

detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml

@@ -1,7 +1,7 @@
 name: Regsvr32 Silent and Install Param Dll Loading
 id: f421c250-24e7-11ec-bc43-acde48001122
 version: 1
-date: '2021-10-04'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -31,12 +31,12 @@ references:
 - https://attack.mitre.org/techniques/T1218/010/
 tags:
   analytic_story:
-  - Data Destruction
-  - Suspicious Regsvr32 Activity
-  - Remcos
+  - AsyncRAT
   - Hermetic Wiper
   - Living Off The Land
-  - AsyncRAT
+  - Data Destruction
+  - Remcos
+  - Suspicious Regsvr32 Activity
   asset_type: Endpoint
   confidence: 60
   impact: 60

detections/endpoint/runas_execution_in_commandline.yml

@@ -1,7 +1,7 @@
 name: Runas Execution in CommandLine
 id: 4807e716-43a4-11ec-a0e7-acde48001122
 version: 1
-date: '2021-11-12'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -31,8 +31,9 @@ references:
 - https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
 tags:
   analytic_story:
-  - Windows Privilege Escalation
+  - Data Destruction
   - Hermetic Wiper
+  - Windows Privilege Escalation
   asset_type: Endpoint
   confidence: 50
   impact: 50

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -38,6 +38,7 @@ tags:
   - AgentTesla
   - Trickbot
   - AsyncRAT
+  - Sandworm Tools
   - Living Off The Land
   - CISA AA22-257A
   - DHS Report TA18-074A

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -1,7 +1,7 @@
 name: Schtasks Run Task On Demand
 id: bb37061e-af1f-11eb-a159-acde48001122
 version: 1
-date: '2021-05-07'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -27,10 +27,11 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
-  - XMRig
-  - Industroyer2
-  - CISA AA22-257A
   - Qakbot
+  - Industroyer2
+  - XMRig
+  - CISA AA22-257A
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 60

detections/endpoint/screensaver_event_trigger_execution.yml

@@ -1,7 +1,7 @@
 name: Screensaver Event Trigger Execution
 id: 58cea3ec-1f6d-11ec-8560-acde48001122
 version: 1
-date: '2021-09-27'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -30,10 +30,11 @@ references:
 - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - Windows Privilege Escalation
-  - Windows Registry Abuse
   - Hermetic Wiper
+  - Windows Privilege Escalation
+  - Windows Persistence Techniques
+  - Windows Registry Abuse
+  - Data Destruction
   asset_type: Endpoint
   confidence: 90
   impact: 80

detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -1,7 +1,7 @@
 name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
 id: c2590137-0b08-4985-9ec5-6ae23d92f63d
 version: 8
-date: '2022-11-14'
+date: '2023-04-14'
 author: Steven Dick, Patrick Bareiss, Splunk
 status: production
 type: TTP
@@ -33,10 +33,11 @@ known_false_positives: Administrators may attempt to change the default executio
 references: []
 tags:
   analytic_story:
-  - Hermetic Wiper
-  - Malicious PowerShell
-  - Credential Dumping
   - HAFNIUM Group
+  - Hermetic Wiper
+  - Credential Dumping
+  - Malicious PowerShell
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   impact: 60

detections/endpoint/suspicious_copy_on_system32.yml

@@ -34,6 +34,7 @@ tags:
   - Qakbot
   - IcedID
   - AsyncRAT
+  - Sandworm Tools
   asset_type: Endpoint
   confidence: 90
   impact: 70

detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process DNS Query Known Abuse Web Services
 id: 3cf0dc36-484d-11ec-a6bc-acde48001122
 version: 2
-date: '2022-01-18'
+date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -29,8 +29,9 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
-  - Remcos
+  - Data Destruction
   - WhisperGate
+  - Remcos
   asset_type: Endpoint
   confidence: 80
   impact: 80

detections/endpoint/suspicious_process_file_path.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process File Path
 id: 9be25988-ad82-11eb-a14f-acde48001122
 version: 1
-date: '2023-01-25'
+date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -35,25 +35,26 @@ references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
-  - Data Destruction
-  - Double Zero Destructor
-  - XMRig
-  - Remcos
-  - WhisperGate
-  - Hermetic Wiper
-  - Industroyer2
-  - DarkCrystal RAT
-  - Brute Ratel C4
-  - AgentTesla
-  - Qakbot
-  - IcedID
-  - Trickbot
   - Azorult
-  - Prestige Ransomware
-  - Chaos Ransomware
-  - LockBit Ransomware
   - AsyncRAT
+  - XMRig
   - Swift Slicer
+  - DarkCrystal RAT
+  - Double Zero Destructor
+  - Trickbot
+  - Data Destruction
+  - LockBit Ransomware
+  - Prestige Ransomware
+  - Industroyer2
+  - Remcos
+  - RedLine Stealer
+  - WhisperGate
+  - IcedID
+  - Hermetic Wiper
+  - AgentTesla
+  - Brute Ratel C4
+  - Qakbot
+  - Chaos Ransomware
   asset_type: Endpoint
   confidence: 50
   impact: 70

detections/endpoint/suspicious_process_with_discord_dns_query.yml

@@ -1,7 +1,7 @@
 name: Suspicious Process With Discord DNS Query
 id: 4d4332ae-792c-11ec-89c1-acde48001122
 version: 2
-date: '2022-06-01'
+date: '2023-04-14'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -27,6 +27,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
+  - Data Destruction
   - WhisperGate
   asset_type: Endpoint
   confidence: 80

detections/endpoint/time_provider_persistence_registry.yml

@@ -27,10 +27,11 @@ references:
 - https://attack.mitre.org/techniques/T1547/003/
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - Windows Privilege Escalation
-  - Windows Registry Abuse
   - Hermetic Wiper
+  - Windows Privilege Escalation
+  - Windows Persistence Techniques
+  - Windows Registry Abuse
+  - Data Destruction
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/unloading_amsi_via_reflection.yml

@@ -1,7 +1,7 @@
 name: Unloading AMSI via Reflection
 id: a21e3484-c94d-11eb-b55b-acde48001122
 version: 1
-date: '2021-06-09'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -37,8 +37,9 @@ references:
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 tags:
   analytic_story:
-  - Hermetic Wiper
   - Malicious PowerShell
+  - Hermetic Wiper
+  - Data Destruction
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/w3wp_spawning_shell.yml

@@ -1,7 +1,7 @@
 name: W3WP Spawning Shell
 id: 0f03423c-7c6a-11eb-bc47-acde48001122
 version: 2
-date: '2021-03-03'
+date: '2023-04-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -36,12 +36,13 @@ references:
 - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 tags:
   analytic_story:
-  - Hermetic Wiper
   - HAFNIUM Group
+  - CISA AA22-264A
+  - Hermetic Wiper
+  - ProxyNotShell
   - ProxyShell
   - CISA AA22-257A
-  - ProxyNotShell
-  - CISA AA22-264A
+  - Data Destruction
   asset_type: Endpoint
   confidence: 80
   cve:

detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml

@@ -41,9 +41,10 @@ tags:
   - SubcategoryGuid
   risk_score: 60
   security_domain: endpoint
+  manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested
 tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_gpo/windows-security-xml.log
     source: XmlWinEventLog:Security
-    sourcetype: xmlwineventlog
+    sourcetype: xmlwineventlog

detections/endpoint/windows_ad_domain_replication_acl_addition.yml

@@ -4,7 +4,7 @@ version: 1
 date: "2022-11-18"
 author: Dean Luxton
 type: TTP
-status: production
+status: experimental
 data_source: []
 description:
   This analytic detects the addition of the permissions necessary to perform a DCSync attack.
@@ -13,7 +13,7 @@ description:
   - DS-Replication-Get-Changes-All
   Certain Sync operations may require the additional permission of DS-Replication-Get-Changes-In-Filtered-Set.
   By default, adding DCSync permissions via the Powerview Add-ObjectACL operation adds all 3. This alert identifies where this trifecta has been met, and also where just the base level requirements have been met.
-search: '`wineventlog_security`   | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?P<DSRGetChangesFiltered_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")| where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded  objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`'
+search: '`wineventlog_security`  | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?P<DSRGetChangesFiltered_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")| where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded  objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`'
 how_to_implement:
   To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting
   `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to  `Write All Properties`
@@ -61,6 +61,7 @@ tags:
     - ObjectClass
   risk_score: 80
   security_domain: endpoint
+  manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested.
 tests:
   - name: True Positive Test
     attack_data: