Branch was auto-updated.

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -0,0 +1,44 @@
+name: Creation of lsass Dump with Taskmgr
+id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
+version: 1
+date: '2020-02-03'
+description: Detect the hands on keyboard behavior of Windows Task Manager creating
+  a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification
+  will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp,
+  cannot be renamed, however if the dump occurs more than once, it will be named lsass
+  (2).dmp.
+how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
+  includes EventCode 11 for detecting file create of lsass.dmp. This search uses an
+  input macro named `sysmon`. We strongly recommend that you specify your environment-specific
+  configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace
+  the macro definition with configurations for your Splunk environment. The search
+  also uses a post-filter macro designed to filter out known false positives.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager
+- https://attack.mitre.org/techniques/T1003/001/
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp |
+  stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category,
+  process_name, TargetFilename | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`'
+known_false_positives: Administrators can create memory dumps for debugging purposes,
+  but memory dumps of the LSASS process would be unusual.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 6
+  - CIS 8
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Windows
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/creation_of_shadow_copy.yml

@@ -1,45 +1,40 @@
-author: Patrick Bareiss, Splunk
+name: Creation of Shadow Copy
+id: eb120f5f-b879-4a63-97c1-93352b5df844
+version: 1
 date: '2019-12-10'
-description: Monitor for signs that Ntdsutil, Vssadmin, or Wmic has been used to create
+description: Monitor for signs that Vssadmin or Wmic has been used to create
   a shadow copy.
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
   field in the Endpoint data model.
-id: eb120f5f-b879-4a63-97c1-93352b5df844
-known_false_positives: Legtimate administrator usage of Ntdsutil, Vssadmin, or Wmic
-  will create false positives.
-name: Creation of Shadow Copy
+type: ESCU
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+author: Patrick Bareiss, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe
-  Processes.process=*ntds* Processes.process=*create*) OR (Processes.process_name=vssadmin.exe
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
   Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe
   Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user
   Processes.process_name Processes.process  Processes.parent_process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`'
+known_false_positives: Legitimate administrator usage of Vssadmin or Wmic
+  will create false positives.
 tags:
   analytics_story:
   - Credential Dumping
-  asset_type: Endpoint
-  automated_detection_testing: passed
+  mitre_attack_id:
+  - T1003.003
+  kill_chain_phases:
+  - Actions on Objectives
   cis20:
   - CIS 8
   - CIS 16
-  dataset:
-  - hhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Actions on Objectives
-  mitre_attack_id:
-  - T1003.003
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
   security_domain: endpoint
-type: ESCU
-version: 1
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_regsvr32_application_control_bypass.yml

@@ -0,0 +1,50 @@
+name: Detect Regsvr32 Application Control Bypass
+id: 070e9b80-6252-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-28'
+description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
+  Regsvr32.exe is a command-line program used to register and unregister object linking
+  and embedding controls, including dynamic link libraries (DLLs), on Windows systems.
+  Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is
+  often referred to as a "Squiblydoo" attack. \
+
+  Upon investigating, look for network connections to remote destinations (internal
+  or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll"
+  is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon
+  execution. '
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe
+  OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`'
+known_false_positives: Limited false positives related to third party software registering
+  .DLL's.
+tags:
+  analytics_story:
+  - Suspicious Regsvr32 Activity
+  mitre_attack_id:
+  - T1218.010
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml

@@ -0,0 +1,47 @@
+name: Detect Rundll32 Application Control Bypass - advpack
+id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe loading advpack.dll and
+  ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique
+  will load script code from a file. Upon a successful execution, the following module
+  loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
+  script content origination. Generally, a child process will spawn from rundll32.exe,
+  but that may be bypassed based on script code contents. Rundll32.exe is natively
+  found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any
+  network connections and obtain the script content executed. It's possible other files are on disk.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Advpack/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*advpack* by Processes.user Processes.process_name
+  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___advpack_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive. 
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml

@@ -0,0 +1,48 @@
+name: Detect Rundll32 Application Control Bypass - setupapi
+id: 61e7b44a-6088-4f26-b788-9a96ba13b37a
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe loading setupapi.dll and
+  iesetupapi.dll by calling the LaunchINFSection function on the command line. This
+  particular technique will load script code from a file. Upon a successful execution,
+  the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During
+  investigation, identify script content origination. Generally, a child process will
+  spawn from rundll32.exe, but that may be bypassed based on script code contents.
+  Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
+  investigation, review any network connections and obtain the script content executed.
+  It's possible other files are on disk.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Setupapi/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process
+  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use setupapi
+  triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml

@@ -0,0 +1,48 @@
+name: Detect Rundll32 Application Control Bypass - syssetup
+id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe loading syssetup.dll by
+  calling the LaunchINFSection function on the command line. This particular technique
+  will load script code from a file. Upon a successful execution, the following module
+  loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify
+  script content origination. Generally, a child process will spawn from rundll32.exe,
+  but that may be bypassed based on script code contents. Rundll32.exe is natively
+  found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review
+  any network connections and obtain the script content executed. It's possible other
+  files are on disk.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Syssetup/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process
+  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll,
+  triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -1,42 +1,39 @@
-author: Patrick Bareiss, Splunk
+name: Dump LSASS via comsvcs DLL
+id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
+version: 1
 date: '2020-02-21'
 description: Detect the usage of comsvcs.dll for dumping the lsass process.
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
   field in the Endpoint data model.
-id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
-known_false_positives: None identified.
-name: Dump LSASS via comsvcs DLL
+type: ESCU
 references:
 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
 - https://twitter.com/SBousseaden/status/1167417096374050817
+author: Patrick Bareiss, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
   Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name
   Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`'
+known_false_positives: None identified.
 tags:
   analytics_story:
   - Credential Dumping
-  asset_type: Endpoint
-  automated_detection_testing: passed
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
   cis20:
   - CIS 3
   - CIS 5
   - CIS 16
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
-  kill_chain_phases:
-  - Actions on Objectives
-  mitre_attack_id:
-  - T1003.001
   nist:
   - DE.CM
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
   security_domain: endpoint
-type: ESCU
-version: 1
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log

detections/endpoint/dump_lsass_via_procdump.yml

@@ -0,0 +1,46 @@
+name: Dump LSASS via procdump
+id: 3742ebfe-64c2-11eb-ae93-0242ac130002
+version: 1
+date: '2021-02-01'
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe.
+  Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on the command
+  line. Review other endpoint data sources for cross process (injection) into lsass.exe.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
+  (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by
+  Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
+known_false_positives: None identified.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/dump_lsass_via_procdump_rename.yml

@@ -0,0 +1,46 @@
+name: Dump LSASS via procdump Rename
+id: 21276daa-663d-11eb-ae93-0242ac130002
+version: 1
+date: '2021-02-01'
+description: 'Detect a renamed instance of procdump.exe dumping the lsass process.
+  This query looks for both -mm and -ma usage. -mm will produce a mini dump file and
+  -ma will write a dump file with all process memory. Both are highly suspect and
+  should be reviewed. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+author: Michael Haag, Splunk
+search: '`sysmon` OriginalFileName=procdump  process_name!=procdump*.exe  EventID=1
+  (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as
+  dest |  stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
+  process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`'
+known_false_positives: None identified.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/ntdsutil_export_ntds.yml

@@ -0,0 +1,51 @@
+name: Ntdsutil export ntds
+id: da63bc76-61ae-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-28'
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+author: Michael Haag, Patrick Bareiss, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe
+  Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`'
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.003
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -0,0 +1,47 @@
+name: Suspicious Regsvr32 Register Suspicious Path
+id: 62732736-6250-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-28'
+description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
+  by using non-standard file extensions to load malciious DLLs. Upon investigating,
+  look for network connections to remote destinations (internal or external). Review
+  additional parrallel processes and child processes for additional activity.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model. Tune the query by filtering additional extensions
+  found to be used by  legitimate processes.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
+- https://any.run/report/f29a7d2ecd3585e1e4208e44bcc7156ab5388725f1d29d03e7699da0d4598e7c/0826458b-5367-45cf-b841-c95a33a01718
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe
+  (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*)
+  (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
+known_false_positives: Limited false positives with the query restricted to specified
+  paths. Add more world writeable paths as tuning continues.
+tags:
+  analytics_story:
+  - Suspicious Regsvr32 Activity
+  mitre_attack_id:
+  - T1218.010
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  - CIS 16
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/suspicious_rundll32_dllregisterserver.yml

@@ -0,0 +1,50 @@
+name: Suspicious Rundll32 dllregisterserver
+id: 8c00a385-9b86-4ac0-8932-c9ec3713b159
+version: 1
+date: '2021-02-09'
+description: The following analytic identifies rundll32.exe using dllregisterserver
+  on the command line to load a DLL. When a DLL is registered, the DllRegisterServer
+  method entry point in the DLL is invoked. This is typically seen when a DLL is being
+  registered on the system. Not every instance is considered malicious, but it will
+  capture malicious use of it. During investigation, review the parent process and
+  parrellel processes executing. Capture the DLL being loaded and inspect further.
+  Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east
+- https://github.com/pan-unit42/tweets/blob/master/2020-12-10-IOCs-from-Ursnif-infection-with-Delf-variant.txt
+- https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/
+- https://msdn.microsoft.com/en-us/library/windows/desktop/ms682162(v=vs.85).aspx
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_dllregisterserver_filter`'
+known_false_positives: This is likely to produce false positives and will require
+  some filtering. Tune the query by adding command line paths to known good DLLs,
+  or filtering based on parent process names.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/suspicious_rundll32_rename.yml

@@ -0,0 +1,45 @@
+name: Suspicious Rundll32 Rename
+id: 7360137f-abad-473e-8189-acbdaa34d114
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies renamed instances of rundll32.exe executing.
+  rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
+  investigation, validate it is the legitimate rundll32.exe executing and what script
+  content it is loading. This query relies on the OriginalFileName from Sysmon, or
+  internal name from the PE meta data. Expand the query as needed by looking for specific
+  command line arguments outlined in other analytics.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 OriginalFileName=RUNDLL32.EXE NOT process_name=rundll32.exe
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_rundll32_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  - T1036.003
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/suspicious_rundll32_startw.yml

@@ -0,0 +1,50 @@
+name: Suspicious Rundll32 StartW
+id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
+version: 1
+date: '2021-02-04'
+description: The following analytic identifies rundll32.exe executing a DLL function
+  name, Start and StartW, on the command line that is commonly observed with CobaltStrike
+  x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32
+  and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world
+  writeable path or user location. In most instances it will not have a valid certificate
+  (Unsigned). During investigation, review the parent process and other parallel application
+  execution. Capture and triage the DLL in question. In the instance of CobaltStrike,
+  rundll32.exe is the default process it opens and injects shellcode into. This default
+  process can be changed, but typically is not.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://www.cobaltstrike.com/help-windows-executable
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Advpack/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process=*start* by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_startw_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use Start
+  as a function and call it via the command line. Filter as needed.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml

@@ -0,0 +1,46 @@
+name: Suspicious Rundll32 no CommandLine Arguments
+id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
+version: 1
+date: '2021-02-09'
+description: The following analytic identifies rundll32.exe with no command line arguments.
+  It is unusual for rundll32.exe to execute with no command line arguments present.
+  This particular behavior is common with malicious software, including CobaltStrike.
+  During investigation, identify any network connections and parallel processes. Identify
+  any suspicious module loads related to credential dumping or file writes. Rundll32.exe
+  is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://lolbas-project.github.io/lolbas/Libraries/Advpack/
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE)
+  | regex CommandLine="(rundll32\.exe.{0,4}$)" | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name,
+  OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_commandline_arguments_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious Rundll32 Activity
+  mitre_attack_id:
+  - T1218.011
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

stories/suspicious_mshta_activity.yml

@@ -1,30 +1,39 @@
-author: Bhavin Patel, Michael Haag, Splunk
+name: Suspicious MSHTA Activity
+id: 2b1800dd-92f9-47dd-a981-fdf13w1q5d55
+version: 2
 date: '2021-01-20'
 description: Monitor and detect techniques used by attackers who leverage the mshta.exe
   process to execute malicious code.
-id: 2b1800dd-92f9-47dd-a981-fdf13w1q5d55
-name: Suspicious MSHTA Activity
-narrative: 'One common adversary tactic is to bypass application white-listing solutions
-  via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll)
-  with the .hta suffix. In these cases, attackers use the trusted Windows utility
-  to proxy execution of malicious files, whether an .hta application, javascript,
-  or VBScript.\
+narrative: 'One common adversary tactic is to bypass application control solutions
+  via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta
+  suffix. In these cases, attackers use the trusted Windows utility to proxy execution
+  of malicious files, whether an .hta application, javascript, or VBScript.\
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an attacker is leveraging mshta.exe to execute malicious code.
-  \
+  may indicate that an attacker is leveraging mshta.exe to execute malicious code.\
+  
+  Triage\
+  Validate execution \
+  1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\
+  
+  1. Determine if script code was executed with MSHTA.\
+  
+  Situational Awareness\
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by MSHTA.exe.\
 
-  Triage \ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName
-  of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32
-  or c:\windows\syswow64, it should be highly suspect. 2. Determine if script code
-  was executed with MSHTA. \ Situational Awareness \ The objective of this step is
-  meant to identify suspicious behavioral indicators related to executed of Script
-  code by MSHTA.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is
-  the parent process an Office Application? 2. Module loads. Are the known MSHTA.exe
-  modules being loaded by a non-standard application? Is MSHTA loading any suspicious
-  .DLLs? 3. Network connections. Any network connections? Review the reputation of
-  the remote IP or domain. \ Retrieval of script code \ The objective of this step
-  is to confirm the executed script code is benign or malicious.'
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+
+  1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is
+  MSHTA loading any suspicious .DLLs?\
+
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  
+  Retrieval of script code\
+  The objective of this step is to confirm the executed script code is benign or malicious.'
+author: Bhavin Patel, Michael Haag, Splunk
+type: ESCU
 references:
 - https://redcanary.com/blog/introducing-atomictestharnesses/
 - https://redcanary.com/blog/windows-registry-attacks-threat-detection/
@@ -32,12 +41,6 @@ references:
 - https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
 tags:
   analytics_story: Suspicious MSHTA Activity
+  usecase: Advanced Threat Detection
   category:
   - Adversary Tactics
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Advanced Threat Detection
-type: ESCU
-version: 2

stories/suspicious_regsvr32_activity.yml

@@ -0,0 +1,33 @@
+name: Suspicious Regsvr32 Activity
+id: b8bee41e-624f-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-29'
+description: Monitor and detect techniques used by attackers who leverage the regsvr32.exe
+  process to execute malicious code.
+narrative: 'One common adversary tactic is to bypass application control solutions
+  via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo"
+  using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used
+  by adversaries to bypass detection and prevention controls. 
+  The file extension of the DLL is irrelevant (it may load a .txt file extension for example). 
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code.  
+  Validate execution 
+  Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
+  Determine if script code was executed with regsvr32.  
+  Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by regsvr32.exe. 
+  Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
+  Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. 
+  Network connections. Any network connections? Review the reputation of the remote IP or domain.     
+  Retrieval of Script Code - confirm the executed script code is benign or malicious.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+tags:
+  analytics_story: Suspicious Regsvr32 Activity
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics

stories/suspicious_rundll32_activity.yml

@@ -0,0 +1,22 @@
+name: Suspicious Rundll32 Activity
+id: 80a65487-854b-42f1-80a1-935e4c170694
+version: 1
+date: '2021-02-03'
+description: Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.
+narrative: 'One common adversary tactic is to bypass application control solutions
+  via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. 
+  The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. 
+  Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. 
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging rundll32.exe to execute malicious code.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+tags:
+  analytics_story: Suspicious Rundll32 Activity
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics

stories/trusted_developer_utilities_proxy_execution_msbuild.yml

@@ -1,35 +1,49 @@
-author: Michael Haag, Splunk
+name: Trusted Developer Utilities Proxy Execution MSBuild
+id: be3418e2-551b-11eb-ae93-0242ac130002
+version: 1
 date: '2021-01-21'
 description: Monitor and detect techniques used by attackers who leverage the msbuild.exe
   process to execute malicious code.
-id: be3418e2-551b-11eb-ae93-0242ac130002
-name: Trusted Developer Utilities Proxy Execution MSBuild
-narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted
+narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted 
   Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform
   used by Visual Studio and is native to Windows. It handles XML formatted project
-  files that define requirements for loading and building various platforms and configurations.
-  \
+  files that define requirements for loading and building various platforms and configurations.\
 
   The inline task capability of MSBuild that was introduced in .NET version 4 allows
-  for C# code to be inserted into an XML project file. MSBuild will compile and execute
-  the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this
-  way it can execute arbitrary code and bypass application control defenses that are
-  configured to allow MSBuild.exe execution. \
+  for C# code to be inserted into an XML project file. MSBuild will compile and
+  execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is
+  used this way it can execute arbitrary code and bypass application control defenses
+  that are configured to allow MSBuild.exe execution.\
 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.
-  \
+  may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\
+  
+  Triage\
 
-  Triage \ Validate execution \ 1. Determine if MSBuild.exe executed. Validate the
-  OriginalFileName of MSBuild.exe and further PE metadata. 2. Determine if script
-  code was executed with MSBuild. Situational Awareness \ The objective of this step
-  is meant to identify suspicious behavioral indicators related to executed of Script
-  code by MSBuild.exe. \ 1. Parent process. Is the parent process a known LOLBin?
-  Is the parent process an Office Application? 2. Module loads. Are the known MSBuild.exe
-  modules being loaded by a non-standard application? Is MSbuild loading any suspicious
-  .DLLs? 3. Network connections. Any network connections? Review the reputation of
-  the remote IP or domain. \ Retrieval of script code \ The objective of this step
-  is to confirm the executed script code is benign or malicious.'
+  Validate execution\
+
+  1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
+  PE metadata.\
+  
+  1. Determine if script code was executed with MSBuild.\
+  
+  Situational Awareness\
+
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by MSBuild.exe.\
+  
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+  
+  1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
+  MSbuild loading any suspicious .DLLs?\
+  
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  
+  Retrieval of script code\
+  
+  The objective of this step is to confirm the executed script code is benign or malicious.'
+author: Michael Haag, Splunk
+type: ESCU
 references:
 - https://attack.mitre.org/techniques/T1127/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
@@ -39,12 +53,6 @@ references:
 - https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md
 tags:
   analytics_story: Trusted Developer Utilities Proxy Execution MSBuild
-  category:
-  - Adversary Tactics
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
   usecase: Advanced Threat Detection
-type: ESCU
-version: 1
+  category:
+  - Adversary Tactics

tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml

@@ -0,0 +1,12 @@
+name: Creation of lsass dump with taskmgr Unit Test
+tests:
+- name: Creation of lsass dump with taskmgr
+  file: endpoint/creation_of_lsass_dump_with_taskmgr.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_regsvr32_application_control_bypass.test.yml

@@ -0,0 +1,12 @@
+name: Detect Regsvr32 Appication Control Bypass Unit Test
+tests:
+- name: Detect regsvr32 Application Control Bypass
+  file: endpoint/detect_regsvr32_application_control_bypass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_rundll32_application_control_bypass___advpack.test.yml

@@ -0,0 +1,12 @@
+name: Detect Rundll32 Application Control Bypass - advpack
+tests:
+- name: Detect Rundll32 Application Control Bypass - advpack and ieadvpack
+  file: endpoint/detect_rundll32_application_control_bypass___advpack.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_rundll32_application_control_bypass___setupapi.test.yml

@@ -0,0 +1,12 @@
+name: Detect Rundll32 Application Control Bypass - setupapi
+tests:
+- name: Detect Rundll32 Application Control Bypass - setupapi
+  file: endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_rundll32_application_control_bypass___syssetup.test.yml

@@ -0,0 +1,12 @@
+name: Detect Rundll32 Application Control Bypass - syssetup
+tests:
+- name: Detect Rundll32 Application Control Bypass - syssetup
+  file: endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/dump_lsass_via_procdump.test.yml

@@ -0,0 +1,12 @@
+name: Dump LSASS via procdump Unit Test
+tests:
+- name: Dump LSASS via procdump
+  file: endpoint/dump_lsass_via_procdump.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/dump_lsass_via_procdump_rename.test.yml

@@ -0,0 +1,12 @@
+name: Dump lsass via procdump rename Unit Test
+tests:
+- name: Dump lsass via procdump rename
+  file: endpoint/dump_lsass_via_procdump_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/ntdsutil_export_ntds.test.yml

@@ -0,0 +1,12 @@
+name: NTdsutil export ntds dit Unit Test
+tests:
+- name: NTdsutil to export ntds dit from Directory Services
+  file: endpoint/ntdsutil_export_ntds.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_regsvr32_register_suspicious_path.test.yml

@@ -0,0 +1,12 @@
+name: Detect Regsvr32 Register Suspicious Path Unit Test
+tests:
+- name: Detect regsvr32 Registering DLLs from non-standard paths
+  file: endpoint/suspicious_regsvr32_register_suspicious_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_rundll32_dllregisterserver.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Rundll32 dllregisterserver Unit Test
+tests:
+- name: Suspicious Rundll32 dllregisterserver
+  file: endpoint/suspicious_rundll32_dllregisterserver.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_rundll32_rename.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious rundll32 rename unit test
+tests:
+- name: Detect Renamed rundll32.exe Rename
+  file: endpoint/suspicious_rundll32_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_rundll32_startw.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious Rundll32 startw Unit Test
+tests:
+- name: Suspicious Rundll32 startw
+  file: endpoint/suspicious_rundll32_startw.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/suspicious_rundll32_with_no_command_line_arguments.test.yml

@@ -0,0 +1,12 @@
+name: Suspicious rundll32 with no command line arguments Unit Test
+tests:
+- name: Suspicious Rundll32 with no Command Line Arguments
+  file: endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog