Branch was auto-updated.

detections/endpoint/mshtml_module_load_in_office_product.yml

@@ -1,8 +1,8 @@
 name: MSHTML Module Load in Office Product
 id: 5f1c168e-118b-11ec-84ff-acde48001122
-version: 1
-date: '2021-09-09'
-author: Michael Haag, Splunk
+version: 2
+date: '2022-06-01'
+author: Michael Haag, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -14,7 +14,7 @@ description: The following detection identifies the module load of mshtml.dll in
 search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
   ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
-  ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)`
+  ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process names and image loads from your endpoints. If you are using

detections/endpoint/spoolsv_suspicious_loaded_modules.yml

@@ -1,6 +1,6 @@
 name: Spoolsv Suspicious Loaded Modules
 id: a5e451f8-da81-11eb-b245-acde48001122
-version: 1
+version: 2
 date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
 type: TTP
@@ -12,7 +12,7 @@ description: This search is to detect suspicious loading of dll in specific path
 search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*"
   ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded)
   as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer
-  process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)`
+  ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and imageloaded executions from your endpoints. If you

detections/endpoint/suspicious_process_with_discord_dns_query.yml

@@ -1,8 +1,8 @@
 name: Suspicious Process With Discord DNS Query
 id: 4d4332ae-792c-11ec-89c1-acde48001122
-version: 1
-date: '2022-01-19'
-author: Teoderick Contreras, Splunk
+version: 2
+date: '2022-06-01'
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
@@ -11,10 +11,10 @@ description: This analytic identifies a process making a DNS query to Discord, a
   by adversaries, as seen in the WhisperGate campaign, to host and download malicious.
   external files. A process resolving a Discord DNS name could be an indicator of
   malware trying to download files from Discord for further execution.
-search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*"
-  AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats
+search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*"
+  AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats
   count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus
-  process_name QueryResults Computer process_path | `security_content_ctime(firstTime)`
+  process_name QueryResults Computer | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`'
 how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query.
 known_false_positives: Noise and false positive can be seen if the following instant
@@ -68,7 +68,6 @@ tags:
   - process_name
   - QueryResults
   - Computer
-  - process_path
   risk_score: 64
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml

@@ -1,8 +1,8 @@
 name: Wermgr Process Connecting To IP Check Web Services
 id: ed313326-a0f9-11eb-a89c-acde48001122
-version: 1
-date: '2021-04-19'
-author: Teoderick Contreras, Splunk
+version: 2
+date: '2022-06-01'
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -17,8 +17,8 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism
   "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com",
   "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org",
   "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net")
-  |  stats  min(_time) as firstTime max(_time) as lastTime count by  process_path
-  process_name process_id QueryName QueryStatus QueryResults Computer EventCode |
+  |  stats  min(_time) as firstTime max(_time) as lastTime count by Image
+  process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, dns query name process path , and query ststus from

detections/endpoint/windows_installutil_credential_theft.yml

@@ -1,8 +1,8 @@
 name: Windows InstallUtil Credential Theft
 id: ccfeddec-43ec-11ec-b494-acde48001122
-version: 1
-date: '2021-11-12'
-author: Michael Haag, Splunk
+version: 2
+date: '2022-06-01'
+author: Michael Haag, Mauricio Velazo, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -23,7 +23,7 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
   processes. Capture any artifacts and review further.'
 search: '`sysmon` EventCode=7  process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
   "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime
-  by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer
+  by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer
   as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_installutil_credential_theft_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting

macros/printservice.yml

@@ -1,4 +1,4 @@
-definition: source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin"
+definition: source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin"
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: printservice