From 44bc5ac3daeff0dfc7a0048ea5090c7dee7d1379 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 30 Aug 2022 06:38:55 -0600
Subject: [PATCH] Update windows_ingress_tool_transfer_using_explorer.yml

---
 ...s_ingress_tool_transfer_using_explorer.yml | 32 +++++++++++++------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
index 7866b9324f..8b8526b547 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
@@ -1,16 +1,16 @@
 name: Windows Ingress Tool Transfer Using Explorer
 id: 76753bab-f116-4ea3-8fb9-89b638be58a9
-version: 1
-date: '2022-08-01'
+version: 2
+date: '2022-08-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic detects an explorer.exe with a possible url link process command line on it.
-  Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. 
-  So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application 
-  in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
-  which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*")
   by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
@@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: unknown
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
 references:
 - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
 tags:
@@ -43,16 +43,28 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: a explorer process with url link $process$ in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote payload.
   mitre_attack_id:
   - T1105
   nist:
   - DE.CM
   observable:
+  - name: user
+    type: User
+    role:
+    - Victim
   - name: dest
     type: Hostname
     role:
     - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -71,4 +83,4 @@ tags:
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 25
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file