From 405ebb4dae129fa759eefc9acbed6af4c2bc4813 Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Tue, 9 Feb 2021 16:33:53 -0800
Subject: [PATCH] spl update and test file

---
 .../certutil_exe_certificate_extraction.yml        | 14 ++++++--------
 .../certutil_exe_certificate_extraction.test.yml   | 12 ++++++++++++
 2 files changed, 18 insertions(+), 8 deletions(-)
 create mode 100644 tests/endpoint/certutil_exe_certificate_extraction.test.yml

diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index ee4c1ffb67..574d479ad1 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -8,8 +8,11 @@ description: This search looks for arguments to certutil.exe indicating the mani
 type: ESCU
 references: []
 author: Rod Soto, Splunk
-search: 'source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" app="C:\\Windows\\System32\\certutil.exe"
-   CommandLine="certutil.exe  -exportPFX powershellcert.pfx" | table User app CommandLine process_current_directory
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
+  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *"
+   by Processes.parent_process Processes.process_name Processes.process
+  Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)`
    | `certutil_exe_certificate_extraction_filter`'
 known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is
    uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns
@@ -18,12 +21,7 @@ tags:
   analytics_story:
   - Windows Persistence Techniques
   - Cloud Federated Credential Abuse
-  mitre_attack_id:
-  - T1552.004
   kill_chain_phases:
   - Installation
   security_domain: endpoint
-  asset_type: Endpoint
-  automated_detection_testing: n/a
-  dataset:
-  - TBU
+  asset_type: Endpoint
\ No newline at end of file
diff --git a/tests/endpoint/certutil_exe_certificate_extraction.test.yml b/tests/endpoint/certutil_exe_certificate_extraction.test.yml
new file mode 100644
index 0000000000..d7337e7d5e
--- /dev/null
+++ b/tests/endpoint/certutil_exe_certificate_extraction.test.yml
@@ -0,0 +1,12 @@
+name: Certutil exe certificate extraction Unit Test
+tests:
+- name: Certutil exe certificate extraction
+  file: endpoint/certutil_exe_certificate_extraction.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog