Merge branch 'develop' into dcrat-analytics3

2026-06-08 17:32:49 +00:00 · 2022-08-11 11:03:14 -07:00
parent 7422fb3eda 0a4a86475f
commit 45ae7df595
155 changed files with 2829 additions and 1680 deletions
@@ -91,3 +91,18 @@ class NewContentFactory():
            self.output_dto.obj['tags']['category'] = answers['category']
            self.output_dto.obj['tags']['product'] = ['Splunk Enterprise','Splunk Enterprise Security','Splunk Cloud']
            self.output_dto.obj['tags']['usecase'] = answers['usecase']
+
+
+        elif input_dto.type == SecurityContentType.attack_data:
+            questions = NewContentQuestions.get_questions_attack_data()
+            answers = questionary.prompt(questions)
+            self.output_dto.obj['author'] = answers['author_name']
+            self.output_dto.obj['id'] = str(uuid.uuid4())
+            self.output_dto.obj['date'] = datetime.today().strftime('%Y-%m-%d')
+            self.output_dto.obj['description'] = "description"
+            self.output_dto.obj['environment'] = "attackrange"
+            self.output_dto.obj['dataset'] = "datasets"
+            self.output_dto.obj['sourcetypes'] = answers['data_src_category']
+            self.output_dto.obj['references'] = [answers['references']]
+            self.output_dto.obj['src_path'] = answers['src_file_path'].strip()
+            self.output_dto.obj['dst_path'] = answers['dest_file_path'].strip()
@@ -169,4 +169,88 @@ class NewContentQuestions():
                ],
            },
        ]
+        return questions
+
+
+    @classmethod
+    def get_questions_attack_data(self) -> list:
+        questions = [
+            {
+                'type': 'input',
+                'message': 'enter the source file path of your attack_dataset (ex. ~/attack_range/attack_data/stext_sysmon/sysmon.log): ',
+                'name': 'src_file_path',
+            },
+            {
+                'type': 'input',
+                'message': 'enter the dest folder path for your attack_dataset (ex. ~/attack_data/datasets/malware/remcos/remcos_dynwrapx): ',
+                'name': 'dest_file_path',
+            },
+            {
+                'type': 'input',
+                'message': 'enter author name: ',
+                'name': 'author_name',
+                'default': 'STRT',
+            },
+            {
+            'type': 'checkbox',
+            'message': 'select the data source type',
+            'name': 'data_src_category',
+            'choices': [
+                {
+                    'name': 'windows-sysmon.log',
+                    'checked': True
+                },
+                {
+                    'name': 'windows-security.log'
+                },
+                {
+                    'name': 'windows-system.log'
+                },
+                {
+                    'name': 'windows-powershell-xml.log'
+                },
+                {
+                    'name': 'stream_http_events.log'
+                },
+                {
+                    'name': 'aws_cloudtrail_events.json'
+                },
+                {
+                    'name': 'o365_events.json'
+                },
+                {
+                    'name': 'o365_exchange_events.json'
+                },
+                {
+                    'name': 'kubernetes_events.json'
+                },
+                {
+                    'name': 'security_hub_finding.json'
+                },
+                {
+                    'name': 'gsuite_gmail_bigquery.json'
+                },
+                {
+                    'name': 'gsuite_drive_json.json'
+                },
+                {
+                    'name': 'github.json'
+                },
+                {
+                    'name': 'kubernetes_nginx.json'
+                },
+                {
+                    'name': 'circleci.json'
+                },
+                {
+                    'name': 'sysmon_linux.log'
+                },
+                ],
+            },
+            {
+                'type': 'input',
+                'message': 'enter references: ',
+                'name': 'references',
+            },
+        ]
        return questions
@@ -19,4 +19,14 @@ class NewContent:
        factory = NewContentFactory(factory_output_dto)
        factory.execute(input_dto.factory_input_dto)

-        input_dto.adapter.writeObjectNewContent(factory_output_dto.obj, input_dto.factory_input_dto.type)
+        input_dto.adapter.writeObjectNewContent(factory_output_dto.obj, input_dto.factory_input_dto.type)
+
+
+class NewAttackDataContent:
+
+    def execute(self, input_dto: NewContentInputDto) -> None:
+        factory_output_dto = NewContentFactoryOutputDto(dict())
+        factory = NewContentFactory(factory_output_dto)
+        factory.execute(input_dto.factory_input_dto)
+
+        input_dto.adapter.writeObjects(factory_output_dto.obj, input_dto.factory_input_dto.type)
@@ -37,6 +37,7 @@ class DetectionTags(BaseModel):
    risk_level: str = None
    observable_str: str = None
    kill_chain_phases_id: list = None
+    research_site_url: str = None


    @validator('cis20')
@@ -36,6 +36,7 @@ class SecurityContentType(enum.Enum):
    deployments = 7
    investigations = 8
    unit_tests = 9
+    attack_data = 10

 class SecurityContentProduct(enum.Enum):
    ESCU = 1
@@ -0,0 +1,112 @@
+import os
+import re
+from pathlib import Path
+from bin.contentctl_project.contentctl_infrastructure.adapter.yml_writer import YmlWriter
+from bin.contentctl_project.contentctl_core.application.adapter.adapter import Adapter
+from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType
+import shutil
+
+class ObjToAttackDataYmlAdapter(Adapter):
+
+    def __init__(self):
+        self.ATTACK_DATASET_LINK = "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets"
+        self.sourcetype_dict = {
+        'windows-sysmon.log':'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational', 
+        'windows-security.log': 'WinEventLog:Security',
+        'windows-system.log': 'WinEventLog:system',
+        'windows-powershell-xml.log' :'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational',
+        'stream_http_events.log' :'stream:http',
+        'aws_cloudtrail_events.json' :'aws:cloudtrail',
+        'o365_events.json' :'o365:management:activity',
+        'o365_exchange_events.json' :'o365:management:activity',
+        'kubernetes_events.json' :'kubernetes',
+        'security_hub_finding.json' :'aws:securityhub:finding',
+        'gsuite_gmail_bigquery.json' :'gsuite:gmail:bigquery',
+        'gsuite_drive_json.json':'gsuite:drive:json',
+        'github.json' : 'aws:firehose:json',
+        'kubernetes_nginx.json' :'kube:container:controller',
+        'circleci.json' :'circleci',
+        'sysmon_linux.log' :'Syslog:Linux-Sysmon/Operational'                               
+        }
+        return
+
+    def banner(self):
+        print("""
+        inspired from contentctl.py ...
+        running attack dataset utility helper. 
+        warming up "Millenium Falcon"...  
+                      c==o
+                    _/____\_
+            _.,--'" ||^ || "`z._
+            /_/^ ___\||  || _/o\ "`-._
+            _/  ]. L_| || .||  \_/_  . _`--._
+        /_~7  _ . " ||. || /] \ ]. (_)  . "`--.
+        |__7~.(_)_ []|+--+|/____T_____________L|
+        |__|  _^(_) /^   __\____e_   _|
+        |__| (_){_) J ]K{__ L___0_   _]
+        |__| . _(_) \v     /__________|________
+        l__l_ (_). []|+-+-<\^   L  . _   - ---L|
+        \__\    __. ||^l  \Y] /_]  (_) .  _,--'
+            \~_]  L_| || .\ .\\/~.    _,--'"
+            \_\ . __/||  |\  \`-+-<'"
+                "`---._|J__L|X o~~|[\\      
+        -Row      \____/ \___|[//      
+                   `--'   `--+-'
+        """)
+
+    def expand_path(self, in_path: str) -> str:
+        if "~" in in_path:
+            return str(in_path).replace("~", str(Path.home()))
+        else:
+            return in_path
+
+
+    def extract_base_path(self, in_path: str) -> str:
+        return os.path.basename(os.path.normpath(self.expand_path(in_path)))
+
+
+    def gen_attack_data_descp(self, in_path: str) -> str:
+        descp = "Generated datasets for {} in attack range.".format(self.extract_base_path(self.expand_path(in_path)).replace("_"," "))
+        return descp
+
+
+    def writeObjects(self, objects: list, output_path: str, type: SecurityContentType = None) -> None:
+
+        ## check if src_path exist
+        expanded_src_path = self.expand_path(objects['src_path'])
+        expanded_dst_path = self.expand_path(objects['dst_path'])
+        try:
+            st = os.stat(expanded_src_path)
+        except os.error:
+            print("[x] ERROR: File {0} is not exist".format(objects['src_path']))
+            exit()
+
+        ## check if dest_path exist
+        if not os.path.isdir(expanded_dst_path):
+            os.makedirs(expanded_dst_path, exist_ok=True)
+            
+        objects['description'] = self.gen_attack_data_descp(objects['dst_path'])
+        
+        objects['dataset'] = [self.ATTACK_DATASET_LINK + objects['dst_path'].split("datasets")[1] + os.sep + self.extract_base_path(objects['src_path'])]
+        
+        objects['sourcetypes'] = [self.sourcetype_dict[objects['sourcetypes'][0]]]
+        
+        attack_data_yml_file = expanded_dst_path + os.sep + self.extract_base_path(objects['dst_path']).replace(" ", "_") + ".yml"
+        
+        ## copy the dataset to the destination folder
+        shutil.copy(expanded_src_path, expanded_dst_path)
+
+        objects.pop('src_path')
+        
+        objects.pop('dst_path')
+        
+        YmlWriter.writeYmlFile(attack_data_yml_file, objects)
+
+        ## read attackdata file
+        with open(attack_data_yml_file, 'r') as f:
+            self.banner()
+            print("[+] ----------- generated attack data yml file ------------\n")
+            print(f.read())
+
+
+
@@ -14,6 +14,7 @@ class ObjToYmlAdapter(Adapter):

    def writeObjectsInPlace(self, objects: list) -> None:
        for object in objects:
+
            file_path = object['file_path']
            object.pop('file_path')
            object.pop('deprecated')
@@ -28,6 +29,11 @@ class ObjToYmlAdapter(Adapter):
                file_path = os.path.join(output_path, 'complex', file_name)
            else:
                file_path = os.path.join(output_path, 'srs', file_name)
+            
+            # add research object
+            RESEARCH_SITE_BASE = 'https://research.splunk.com/'
+            research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/"
+            obj.tags.research_site_url = research_site_url

            body = FindingReportObject.writeFindingReport(obj)

@@ -53,7 +59,8 @@ class ObjToYmlAdapter(Adapter):
                                "risk_severity": True,
                                "risk_score": True,
                                "security_domain": True,
-                                "required_fields": True
+                                "required_fields": True,
+                                "research_site_url": True
                            },
                        "test": 
                            {
@@ -86,7 +93,6 @@ class ObjToYmlAdapter(Adapter):
            f.write(data)
            f.close()       

-
    def writeObjectNewContent(self, object: dict, type: SecurityContentType) -> None:
        if type == SecurityContentType.detections:
            file_path = os.path.join(self.input_path, 'detections', object['source'], self.convertNameToFileName(object['name'],object['tags']['product']))
@@ -1,5 +1,5 @@
 service,description,category
 *mpssvc*,Windows Firewall Service,security
-*wscsvc*,Windows Security Center Service,securty
+*wscsvc*,Windows Security Center Service,security
 *windefend*,Windows Defender Service,security
 *sysmon*,Sysmon Driver,security
@@ -0,0 +1,205 @@
+handler,ishandler
+"*bingmaps:*",TRUE
+"*calculator:*",TRUE
+"*callto:*",TRUE
+"*conf:*",TRUE
+"*DLNA-PLAYSINGLE:*",TRUE
+"*Explorer.AssocActionId.BurnSelection:*",TRUE
+"*Explorer.AssocActionId.EraseDisc:*",TRUE
+"*Explorer.AssocActionId.ZipSelection:*",TRUE
+"*Explorer.AssocProtocol.search-ms:*",TRUE
+"*Explorer.BurnSelection:*",TRUE
+"*Explorer.EraseDisc:*",TRUE
+"*Explorer.ZipSelection:*",TRUE
+"*feed:*",TRUE
+"*feeds:*",TRUE
+"*file:*",TRUE
+"*FirefoxURL-308046B0AF4A39CB:*",TRUE
+"*ftp:*",TRUE
+"*grvopen:*",TRUE
+"*http:*",TRUE
+"*https:*",TRUE
+"*iehistory:*",TRUE
+"*ierss:*",TRUE
+"*im:*",TRUE
+"*LDAP:*",TRUE
+"*Lync15:*",TRUE
+"*Lync15classic:*",TRUE
+"*ma-chan:*",TRUE
+"*ma-filelink:*",TRUE
+"*mailto:*",TRUE
+"*mapi:*",TRUE
+"*mapi15:*",TRUE
+"*mapi16:*",TRUE
+"*mk:*",TRUE
+"*MMS:*",TRUE
+"*ms-access:*",TRUE
+"*ms-actioncenter:*",TRUE
+"*ms-apprep:*",TRUE
+"*ms-availablenetworks:*",TRUE
+"*ms-cortana:*",TRUE
+"*ms-cxh:*",TRUE
+"*ms-device-enrollment:*",TRUE
+"*ms-excel:*",TRUE
+"*ms-msdt:*",TRUE
+"*ms-penworkspace:*",TRUE
+"*ms-powerpoint:*",TRUE
+"*ms-publisher:*",TRUE
+"*ms-settings:*",TRUE
+"*ms-settings-airplanemode:*",TRUE
+"*ms-settings-bluetooth:*",TRUE
+"*ms-settings-cellular:*",TRUE
+"*ms-settings-connectabledevices:*",TRUE
+"*ms-settings-displays-topology:*",TRUE
+"*ms-settings-emailandaccounts:*",TRUE
+"*ms-settings-language:*",TRUE
+"*ms-settings-location:*",TRUE
+"*ms-settings-lock:*",TRUE
+"*ms-settings-mobilehotspot:*",TRUE
+"*ms-settings-notifications:*",TRUE
+"*ms-settings-power:*",TRUE
+"*ms-settings-privacy:*",TRUE
+"*ms-settings-proximity:*",TRUE
+"*ms-settings-screenrotation:*",TRUE
+"*ms-settings-wifi:*",TRUE
+"*ms-settings-workplace:*",TRUE
+"*ms-teams:*",TRUE
+"*ms-windows-search:*",TRUE
+"*ms-word:*",TRUE
+"*mssharepointclient:*",TRUE
+"*msteams:*",TRUE
+"*mswindowsmusic:*",TRUE
+"*mswindowsvideo:*",TRUE
+"*odopen:*",TRUE
+"*OneIndex16:*",TRUE
+"*OneNote:*",TRUE
+"*OneNote.URL.16:*",TRUE
+"*OneNoteDesktop:*",TRUE
+"*OneNoteDesktop.URL.16:*",TRUE
+"*Outlook.URL.feed.15:*",TRUE
+"*Outlook.URL.mailto.15:*",TRUE
+"*Outlook.URL.stssync.15:*",TRUE
+"*Outlook.URL.webcal.15:*",TRUE
+"*res:*",TRUE
+"*rlogin:*",TRUE
+"*search:*",TRUE
+"*search-ms:*",TRUE
+"*sip:*",TRUE
+"*sips:*",TRUE
+"*skypecast15:*",TRUE
+"*stssync:*",TRUE
+"*tbauth:*",TRUE
+"*tel:*",TRUE
+"*telnet:*",TRUE
+"*tn3270:*",TRUE
+"*webcal:*",TRUE
+"*webcals:*",TRUE
+"*windows.tbauth:*",TRUE
+"*WMP11.AssocProtocol.DLNA-PLAYSINGLE:*",TRUE
+"*WMP11.AssocProtocol.MMS:*",TRUE
+"*Word:*",TRUE
+"*xbox-tcui:*",TRUE
+"*appinstaller.oauth2:*",TRUE
+"*bingnews:*",TRUE
+"*bingweather:*",TRUE
+"*feedback-hub:*",TRUE
+"*git-client:*",TRUE
+"*IE.HTTP:*",TRUE
+"*insiderhub:*",TRUE
+"*microsoft-edge:*",TRUE
+"*microsoft-edge-holographic:*",TRUE
+"*microsoft.windows.camera:*",TRUE
+"*microsoft.windows.camera.multipicker:*",TRUE
+"*microsoft.windows.camera.picker:*",TRUE
+"*microsoft.windows.photos.crop:*",TRUE
+"*microsoft.windows.photos.picker:*",TRUE
+"*microsoft.windows.photos.videoedit:*",TRUE
+"*Microsoft.Workfolders:*",TRUE
+"*microsoftvideo:*",TRUE
+"*ms-aad-brokerplugin:*",TRUE
+"*ms-appinstaller:*",TRUE
+"*ms-calculator:*",TRUE
+"*ms-clock:*",TRUE
+"*ms-contact-support:*",TRUE
+"*ms-cortana2:*",TRUE
+"*ms-cxh-full:*",TRUE
+"*ms-default-location:*",TRUE
+"*ms-device-enrollment2:*",TRUE
+"*ms-drive-to:*",TRUE
+"*ms-edu-secureassessment:*",TRUE
+"*ms-eyecontrolspeech:*",TRUE
+"*ms-gamebar:*",TRUE
+"*ms-gamebarservices:*",TRUE
+"*ms-gamingoverlay:*",TRUE
+"*ms-get-started:*",TRUE
+"*ms-getoffice:*",TRUE
+"*ms-inputapp:*",TRUE
+"*ms-insights:*",TRUE
+"*ms-meetnow:*",TRUE
+"*ms-meetnowflyout:*",TRUE
+"*ms-mmsys:*",TRUE
+"*ms-msime-imepad:*",TRUE
+"*ms-msime-imjpdct:*",TRUE
+"*ms-officeapp:*",TRUE
+"*ms-officecmd:*",TRUE
+"*ms-oobenetwork:*",TRUE
+"*ms-people:*",TRUE
+"*ms-perception-simulation:*",TRUE
+"*ms-phone:*",TRUE
+"*ms-photos:*",TRUE
+"*ms-powerautomate:*",TRUE
+"*ms-print-addprinter:*",TRUE
+"*ms-print-printjobs:*",TRUE
+"*ms-quick-assist:*",TRUE
+"*ms-rdx-document:*",TRUE
+"*ms-retaildemo-launchbioenrollment:*",TRUE
+"*ms-retaildemo-launchstart:*",TRUE
+"*ms-screenclip:*",TRUE
+"*ms-screensketch:*",TRUE
+"*ms-search:*",TRUE
+"*ms-sttoverlay:*",TRUE
+"*ms-taskswitcher:*",TRUE
+"*ms-to-do:*",TRUE
+"*ms-todo:*",TRUE
+"*ms-unistore-email:*",TRUE
+"*ms-virtualtouchpad:*",TRUE
+"*ms-walk-to:*",TRUE
+"*ms-wcrv:*",TRUE
+"*ms-windows-store:*",TRUE
+"*ms-windows-store-deskext:*",TRUE
+"*ms-windows-store2:*",TRUE
+"*ms-wpc:*",TRUE
+"*ms-wpdrmv:*",TRUE
+"*ms-wxh:*",TRUE
+"*ms-xbet-survey:*",TRUE
+"*ms-xbl-3d8b930f:*",TRUE
+"*ms-xgpueject:*",TRUE
+"*msgamepass:*",TRUE
+"*msgamingapp:*",TRUE
+"*msnews:*",TRUE
+"*msnnews:*",TRUE
+"*msnweather:*",TRUE
+"*msxbox:*",TRUE
+"*outlookaccounts:*",TRUE
+"*outlookcal:*",TRUE
+"*outlookmail:*",TRUE
+"*read:*",TRUE
+"*vscode:*",TRUE
+"*vsls:*",TRUE
+"*vstfs:*",TRUE
+"*vsweb:*",TRUE
+"*windows-feedback:*",TRUE
+"*windowsdefender:*",TRUE
+"*xboxliveapp-1297287741:*",TRUE
+"*zune:*",TRUE
+"*SecureBrowser.security.getDeviceInfo:*",TRUE
+"*SecureBrowser.security.getMACAddress:*",TRUE
+"*SecureBrowser.security.examineProcessList:*",TRUE
+"*SecureBrowser.security.isRemoteSession:*",TRUE
+"*SecureBrowser.security.isVMSession:*",TRUE
+"*JavaScript:*",TRUE
+"*vbscript:*",TRUE
+"*about:*",TRUE
+"*ms-its:*",TRUE
+"*its:*",TRUE
+"*mk:@MSITStore:*",TRUE
@@ -1 +1 @@
-{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}
+{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}
@@ -1 +1 @@
-{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "check_references": false, "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/private/tmp/pytest/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]}
+{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/p4t12ick/projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection", "providing_technologies": ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]}]}
@@ -1 +1 @@
-{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
+{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
@@ -1 +1 @@
-{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "check_references": false, "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]}
+{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]}
@@ -53,6 +53,7 @@ tags:
  risk_score: 42
  security_domain: endpoint
  risk_severity: low
+  research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/
 test:
  name: Anomalous usage of Archive Tools Unit Test
  tests:
@@ -53,6 +53,7 @@ tags:
  risk_score: 42
  security_domain: endpoint
  risk_severity: low
+  research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/
 test:
  name: Anomalous usage of Archive Tools Unit Test
  tests:
@@ -10,7 +10,7 @@ from bin.contentctl_project.contentctl_core.application.use_cases.content_change
 from bin.contentctl_project.contentctl_core.application.use_cases.generate import GenerateInputDto, Generate
 from bin.contentctl_project.contentctl_core.application.use_cases.validate import ValidateInputDto, Validate
 from bin.contentctl_project.contentctl_core.application.use_cases.doc_gen import DocGenInputDto, DocGen
-from bin.contentctl_project.contentctl_core.application.use_cases.new_content import NewContentInputDto, NewContent
+from bin.contentctl_project.contentctl_core.application.use_cases.new_content import NewContentInputDto, NewContent, NewAttackDataContent
 from bin.contentctl_project.contentctl_core.application.use_cases.reporting import ReportingInputDto, Reporting
 from bin.contentctl_project.contentctl_core.application.factory.factory import FactoryInputDto
 from bin.contentctl_project.contentctl_core.application.factory.ba_factory import BAFactoryInputDto
@@ -33,7 +33,7 @@ from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_svg_adapter
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_attack_nav_adapter import ObjToAttackNavAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment import AttackEnrichment
 from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType
-
+from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_attackdata_yml_adapter import ObjToAttackDataYmlAdapter

 def init():

@@ -238,13 +238,19 @@ def new_content(args) -> None:
        contentType = SecurityContentType.detections
    elif args.type == 'story':
        contentType = SecurityContentType.stories
+    elif args.type == 'attack_data':
+        contentType = SecurityContentType.attack_data
    else:
        print("ERROR: type " + args.type + " not supported")
        sys.exit(1)

    new_content_factory_input_dto = NewContentFactoryInputDto(contentType)
-    new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter(args.path))
-    new_content = NewContent()
+    if args.type == 'attack_data':
+        new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToAttackDataYmlAdapter())
+        new_content = NewAttackDataContent()
+    else:
+        new_content_input_dto = NewContentInputDto(new_content_factory_input_dto, ObjToYmlAdapter(args.path))
+        new_content = NewContent()
    new_content.execute(new_content_input_dto)


@@ -296,6 +302,7 @@ def main(args):
    new_content_parser = actions_parser.add_parser("new_content", help="Create new security content object")
    reporting_parser = actions_parser.add_parser("reporting", help="Create security content reporting")

+
    

    # # new arguments
@@ -69,5 +69,3 @@ tags:
  - All_Changes.user
  risk_score: 36
  security_domain: threat
-  supported_tas:
-  - Splunk_TA_aws-kinesis-firehose
@@ -69,5 +69,3 @@ tags:
  - All_Changes.user
  risk_score: 30
  security_domain: threat
-  supported_tas:
-  - Splunk_TA_aws-kinesis-firehose
@@ -17,7 +17,7 @@ how_to_implement: You need to ingest data from your DNS logs. Specifically you m
  This approach allows you to also create your own localized passive DNS capability
  which can aid you in future investigations. You also need to have run the search
  "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that
-  will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303) custom command. 
+  will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1) custom command. 
 known_false_positives: None at this time
 references: []
 tags:
@@ -40,7 +40,7 @@ tags:
  analytic_story:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 80
  context:
  - Source:Endpoint
@@ -76,6 +76,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 64
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -13,18 +13,18 @@ description: This analytic detects a potential suspicious modification of firewa
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
  Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data =
-  "*|Dir=In|*"  Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path
-  Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
-  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
-  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
-  Processes.parent_process_name Processes.parent_process Processes.process_guid |
-  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
-  dest user parent_process_name parent_process process_name process_path process proc_guid
-  registry_path registry_value_name registry_value_data registry_key_name] | table
-  _time dest user parent_process_name parent_process process_name process_path process
-  proc_guid registry_path registry_value_name registry_value_data registry_key_name
-  | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
+  "*|Dir=In|*"  Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest
+  Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid
+  Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name] | table _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data
+  registry_key_name | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -48,8 +48,8 @@ tags:
  impact: 50
  kill_chain_phases:
  - Exploitation
-  message: Suspicious firewall allow rule modifications were detected via the registry on endpoint
-    $dest$ by user $user$.
+  message: Suspicious firewall allow rule modifications were detected via the registry
+    on endpoint $dest$ by user $user$.
  mitre_attack_id:
  - T1021.001
  - T1021
@@ -77,6 +77,4 @@ tags:
  - Registry.user
  risk_score: 25
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -31,7 +31,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -67,6 +67,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -64,8 +64,6 @@ tags:
  - Registry.dest
  - Registry.registry_value_name
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
  confidence: 50
  impact: 50
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -70,6 +70,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -70,6 +70,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -63,8 +63,6 @@ tags:
  - Registry.dest
  - Registry.registry_value_name
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
  confidence: 50
  impact: 50
@@ -68,6 +68,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 40
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -70,6 +70,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -74,6 +74,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -76,6 +76,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 40
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -72,6 +72,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -72,6 +72,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 25
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 49
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -73,6 +73,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 42
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -68,6 +68,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -38,7 +38,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -76,6 +76,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 90
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -79,6 +79,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -23,7 +23,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a
  OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\*
  OR Filesystem.file_path = *\\AppData\\Local\\Temp* OR Filesystem.file_path = *\\PerfLogs\\*)
  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `executables_or_script_creation_in_suspicious_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
@@ -35,7 +35,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
  analytic_story:
-  - Double Zero Destructor 
+  - Double Zero Destructor
  - Data Destruction
  - XMRig
  - Remcos
@@ -85,6 +85,4 @@ tags:
  - Filesystem.user
  risk_score: 56
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -28,7 +28,7 @@ tags:
  analytic_story:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -64,6 +64,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -74,3 +74,5 @@ tags:
  - Processes.parent_process_name
  risk_score: 36
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -55,8 +55,6 @@ tags:
  - Filesystem.user
  - Filesystem.file_path
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
  confidence: 50
  impact: 50
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime
  | lookup ut_shannon_lookup word AS user
  | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1
  | sort count, - ut_shannon 
-  | eval incorrect_password=user
+  | eval incorrect_cred=user
  | eval endtime=endtime+1000
  | map maxsearches=70 search="| tstats `security_content_summariesonly`
  earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype
@@ -29,10 +29,10 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime
  earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\"
  | `drop_dm_object_name(\"Authentication\")`
  | `potential_password_in_username_false_positive_reduction`
-  | eval incorrect_password=\"$incorrect_password$\"
+  | eval incorrect_cred=\"$incorrect_cred$\"
  | eval ut_shannon=\"$ut_shannon$\"
  | sort count"
-  | where user!=incorrect_password 
+  | where user!=incorrect_cred
  | outlier action=RM count
  | `potential_password_in_username_filter`'
 how_to_implement: To successfully implement this search, you need to have relevant
@@ -92,4 +92,4 @@ tags:
  - Authentication.dest
  - sourcetype
  risk_score: 21
-  security_domain: access
+  security_domain: access
@@ -9,8 +9,7 @@ datamodel:
 description: The search looks for modifications to registry keys that can be used
  to launch an application or service at system startup.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry
-  where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
+  as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
  OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
@@ -24,13 +23,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion"
  AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session
  Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run"
-  AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user
-  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  Registry.process_guid Registry.registry_key_name  
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `registry_keys_used_for_persistence_filter`'
+  AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
  that records registry activity from your hosts to populate the endpoint data model
  in the registry node. This is typically populated via endpoint detection-and-response
@@ -95,5 +91,3 @@ tags:
  - Registry.user
  risk_score: 76
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -62,6 +62,4 @@ tags:
  - Registry.user
  risk_score: 90
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -71,6 +71,4 @@ tags:
  - Registry.registry_key_name
  risk_score: 60
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -86,3 +86,5 @@ tags:
  - Processes.parent_process_name
  risk_score: 36
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -65,4 +65,6 @@ tags:
  - Processes.parent_process_id
  risk_score: 25
  security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -82,3 +82,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -59,3 +59,5 @@ tags:
  - Filesystem.user
  risk_score: 70
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -32,7 +32,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 90
  context:
  - Source:Endpoint
@@ -68,6 +68,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 72
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -4,7 +4,7 @@ version: 3
 date: '2020-12-08'
 author: David Dorsey, Splunk
 type: TTP
-datamodel: 
+datamodel:
 - Endpoint
 description: This search looks for shim database files being written to default directories.
  The sdbinst.exe application is used to install shim database files (.sdb). According
@@ -66,3 +66,5 @@ tags:
  - Filesystem.dest
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -94,5 +94,3 @@ tags:
  - cmd_line
  risk_score: 56
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -4,7 +4,7 @@ version: 4
 date: '2020-07-22'
 author: Rico Valdez, Splunk
 type: TTP
-datamodel: 
+datamodel:
 - Endpoint
 description: This search detects writes to the recycle bin by a process other than
  explorer.exe.
@@ -70,3 +70,5 @@ tags:
  security_domain: endpoint
  kill_chain_phases:
  - Exploitation
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -39,7 +39,7 @@ tags:
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  - Windows Registry Abuse
-  - Hermetic Wiper 
+  - Hermetic Wiper
  confidence: 100
  context:
  - Source:Endpoint
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_name
  risk_score: 80
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -6,23 +6,31 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL).
-  In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.
-  During triage, review file modifcations and parallel processes.
+description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running
+  processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution
+  (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition
+  to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import
+  descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe
+  PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an
+  import table entry consisting of the specified DLL into the module at the given
+  base address. During triage, review file modifcations and parallel processes.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*")
-   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_binary_proxy_execution_mavinject_dll_injection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present, filter on DLL name or parent process. 
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe
+  Processes.process IN ("*injectrunning*", "*hmodule=0x*") by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_binary_proxy_execution_mavinject_dll_injection_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present, filter on DLL name or parent
+  process.
 references:
-  - https://attack.mitre.org/techniques/T1218/013/
-  - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process
+- https://attack.mitre.org/techniques/T1218/013/
+- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process
 tags:
  analytic_story:
  - Living Off The Land
@@ -40,7 +48,8 @@ tags:
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting load a DLL.
  mitre_attack_id:
  - T1218.013
  - T1218
@@ -71,14 +80,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code 
-  using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line 
-  that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution.
+description: The following analytic identifies path traversal command-line execution.
+  This technique was seen in malicious document that execute malicious code using
+  msdt.exe and path traversal technique that serve as defense evasion. This TTP is
+  a good pivot to look for more suspicious process and command-line that runs before
+  and after this execution. This may help you to find possible downloaded malware
+  or other lolbin execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Processes where  Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by
-  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`'
+  as lastTime FROM datamodel=Endpoint.Processes where  Processes.process="*\/..\/..\/..\/*"
+  OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
+  Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product
-known_false_positives: Not known at this moment. 
+known_false_positives: Not known at this moment.
 references:
 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
 tags:
@@ -43,7 +45,8 @@ tags:
  impact: 90
  kill_chain_phases:
  - Exploitation
-  message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$
+  message: A parent process $parent_process_name$ has spawned a child $process_name$
+    with path traversal commandline $process$ in $dest$
  mitre_attack_id:
  - T1059
  nist:
@@ -61,14 +64,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -46,7 +46,8 @@ tags:
  impact: 90
  kill_chain_phases:
  - Exploitation
-  message: Multiple cmd.exe processes with child process of notepad.exe executed on $dest$
+  message: Multiple cmd.exe processes with child process of notepad.exe executed on
+    $dest$
  mitre_attack_id:
  - T1059.003
  - T1059
@@ -76,3 +77,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 81
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -75,6 +75,4 @@ tags:
  - Registry.registry_value_data
  risk_score: 64
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
  asset_type: Endpoint
@@ -6,13 +6,15 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. 
-  This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. 
-  This technique was used by threat actor to make its payload more impactful to the compromised host.
+description: This analytic is to detect a suspicious registry modification to disable
+  Lock Computer windows features. This registry modification prevent the user from
+  locking its screen or computer that are being abused by several malware for example
+  ransomware. This technique was used by threat actor to make its payload more impactful
+  to the compromised host.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
-  Registry.registry_value_data = "0x00000001"
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
@@ -21,15 +23,14 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_disable_lock_workstation_feature_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 known_false_positives: unknown
 references:
-  https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
-  https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
+- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
+- https://heimdalsecurity.com/blog/fatalrat-targets-telegram/
 tags:
  analytic_story:
  - Ransomware
@@ -51,17 +52,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -78,4 +78,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,33 +6,35 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. 
-  This registry when enable will prevent users to log off of the system by using any method, 
-  including programs run from the command line, such as scripts. It also disables or removes 
-  all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware 
-  to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect.
-  This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+description: This analytic is to detect a suspicious registry modification to disable
+  logoff feature in windows host. This registry when enable will prevent users to
+  log off of the system by using any method, including programs run from the command
+  line, such as scripts. It also disables or removes all menu items and buttons that
+  log the user off of the system. This technique was seen abused by ransomware malware
+  to make the compromised host un-useful and hard to remove other registry modification
+  made on the machine that needs restart to take effect. This windows feature may
+  implement by administrator in some server where shutdown is critical. In that scenario
+  filter of machine and users that can modify this registry is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" 
-  Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff")
-  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
-  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
-  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
-  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
-  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
-  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
-  proc_guid | fields _time dest user parent_process_name parent_process process_name
-  process_path process proc_guid registry_path registry_value_name registry_value_data]
-  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data
-  | `windows_disable_logoff_button_through_registry_filter`'
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
+  Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data
+  = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
+  _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  Processes.parent_process_name Processes.parent_process Processes.process_guid |
+  `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
+  dest user parent_process_name parent_process process_name process_path process proc_guid
+  registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
+  parent_process process_name process_path process proc_guid registry_path registry_value_name
+  registry_value_data | `windows_disable_logoff_button_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
-known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+known_false_positives: This windows feature may implement by administrator in some
+  server where shutdown is critical. In that scenario filter of machine and users
+  that can modify this registry is needed.
 references:
 - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774
 - https://malwiki.org/index.php?title=DigiPop.xp
@@ -57,17 +59,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -84,4 +85,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. 
-  This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host 
-  un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. 
-  This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+description: This analytic is to detect a suspicious registry modification to disable
+  shutdown button on the logon user. This technique was seen in several malware especially
+  in ransomware family like killdisk malware variant to make the compromised host
+  un-useful and hard to remove other registry modification made on the machine that
+  needs restart to take effect. This windows feature may implement by administrator
+  in some server where shutdown is critical. In that scenario filter of machine and
+  users that can modify this registry is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
-  Registry.registry_value_data = "0x00000000") 
-  OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
+  Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
@@ -24,15 +26,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data
-  | `windows_disable_shutdown_button_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
-known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine 
-  and users that can modify this registry is needed.
+known_false_positives: This windows feature may implement by administrator in some
+  server where shutdown is critical. In that scenario filter of machine and users
+  that can modify this registry is needed.
 references:
-  https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
+- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
 tags:
  analytic_story:
  - Ransomware
@@ -53,17 +55,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -80,4 +81,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,16 +6,20 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to disable windows features. 
-  These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response 
-  from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but 
-  can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed.
+description: This analytic is to detect a suspicious registry modification to disable
+  windows features. These techniques are seen in several ransomware malware to impair
+  the compromised host to make it hard for analyst to mitigate or response from the
+  attack. Disabling these known features make the analysis and forensic response more
+  hard. Disabling these feature is not so common but can still be implemented by the
+  administrator for security purposes. In this scenario filters for users that are
+  allowed doing this is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*"
-  Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", 
-  "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments")
-  Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*"
+  Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu",
+  "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments")
+  Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
@@ -24,8 +28,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_disable_windows_group_policy_features_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
@@ -55,17 +58,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -82,4 +84,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -69,5 +69,3 @@ tags:
  - Registry.registry_path
  risk_score: 24
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -6,24 +6,33 @@ author: Michael Haag, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. 
-  During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product.
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe
-  Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.
+  Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*")
+  AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*"
+  OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
 references:
-  - https://isc.sans.edu/diary/rss/28694
-  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
-  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
-  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
-  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
-  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+- https://isc.sans.edu/diary/rss/28694
+- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
 tags:
  analytic_story:
  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
@@ -43,8 +52,8 @@ tags:
  impact: 100
  kill_chain_phases:
  - Exploitation
-  message: A parent process $parent_process_name$ has spawned a child
-    process $process_name$ on host $dest$ possibly indicative of indirect command execution.
+  message: A parent process $parent_process_name$ has spawned a child process $process_name$
+    on host $dest$ possibly indicative of indirect command execution.
  mitre_attack_id:
  - T1218
  nist:
@@ -74,14 +83,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 100
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,30 +6,32 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. 
-  This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and 
-  ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed.
+description: This analytic is to detect a suspicious registry modification to hide
+  common windows notification feature from compromised host. This technique was seen
+  in some ransomware family to add more impact to its payload that are visually seen
+  by user aside from the encrypted files and ransomware notes. Even this a good anomaly
+  detection, administrator may implement this changes for auditing or security reason.
+  In this scenario filter is needed.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" 
-  Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume")
-  Registry.registry_value_data = "0x00000001" 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
-  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
-  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
-  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
+  Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork",
+  "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by
+  _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data 
-  | `windows_hide_notification_features_through_registry_filter`'
+  process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 known_false_positives: unknown
 references:
-  https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
+- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
 tags:
  analytic_story:
  - Ransomware
@@ -51,17 +53,16 @@ tags:
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
-  - Processes.process_id 
+  - Processes.process_id
  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
  - Processes.parent_process
-  - Processes.process_guid 
+  - Processes.process_guid
  security_domain: endpoint
  impact: 70
-  confidence: 70 
-  # (impact * confidence)/100
+  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
@@ -78,4 +79,6 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  asset_type: Endpoint
+  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,19 +6,18 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The search looks for the deletion of Windows Defender main profile within the registry.
-  This was used by RAT malware across a fleet of endpoints. This particular
-  behavior is typically executed when an adversary gains access to an endpoint
-  and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
+description: The search looks for the deletion of Windows Defender main profile within
+  the registry. This was used by RAT malware across a fleet of endpoints. This particular
+  behavior is typically executed when an adversary gains access to an endpoint and
+  beings to perform execution. Usually, a batch (.bat) will be executed and multiple
  registry and scheduled task modifications will occur. During triage, review parallel
  processes and identify any further file modifications.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry  
-  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted
-  by  Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action  Registry.user Registry.dest
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_delete_win_defender_profile_registry_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows
+  Defender" Registry.action = deleted by  Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid Registry.action  Registry.user
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node.
@@ -71,5 +70,3 @@ tags:
  - Registry.action
  risk_score: 64
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -7,24 +7,28 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies a modification in the Windows registry
-  by the Applocker utility that contains details or registry data values related to denying the execution of several security products. 
-  This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker 
-  commandlet.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*")
-  OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*"
-  AND Registry.registry_value_data = "*Action\=\"Deny\"*" 
-  AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*")
-  by  Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest 
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  by the Applocker utility that contains details or registry data values related to
+  denying the execution of several security products. This technique was seen in Azorult
+  malware where it drops an xml Applocker policy that will deny several AV products
+  and then loaded by using PowerShell Applocker commandlet.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group
+  Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*")
+  OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND
+  Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data
+  IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA
+  SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*",
+  "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*",
+  "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by  Registry.user Registry.registry_path
+  Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest
+  | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_impair_defense_deny_security_software_with_applocker_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: False positives may be present based on organization use of Applocker. Filter as needed.
+known_false_positives: False positives may be present based on organization use of
+  Applocker. Filter as needed.
 references:
 - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
 - https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11
@@ -45,9 +49,10 @@ tags:
  impact: 100
  kill_chain_phases:
  - Exploitation
-  message: Applocker registry modification to deny the action of several AV products on $dest$.
+  message: Applocker registry modification to deny the action of several AV products
+    on $dest$.
  mitre_attack_id:
-  - T1562.001 
+  - T1562.001
  - T1562
  nist:
  - DE.CM
@@ -74,4 +79,6 @@ tags:
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 100
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,19 +6,18 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger set to disable.
-  This is consistent with RAT malware across a fleet of endpoints. This particular
-  behavior is typically executed when an adversary gains access to an endpoint
-  and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
-  registry and scheduled task modifications will occur. During triage, review parallel
-  processes and identify any further file modifications.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start")  Registry.registry_value_data ="0x00000000"
-  by  Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.dest Registry.user
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defenses_disable_win_defender_auto_logging_filter`'
+description: The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger
+  set to disable. This is consistent with RAT malware across a fleet of endpoints.
+  This particular behavior is typically executed when an adversary gains access to
+  an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed
+  and multiple registry and scheduled task modifications will occur. During triage,
+  review parallel processes and identify any further file modifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start"
+  OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start")  Registry.registry_value_data
+  ="0x00000000" by  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
+  Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node.
@@ -71,5 +70,3 @@ tags:
  - Registry.action
  risk_score: 24
  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
@@ -7,25 +7,25 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic detects programs that have been started by forfiles.exe.
-  According to Microsoft, the 'The forfiles command lets you run a command on or pass 
+  According to Microsoft, the 'The forfiles command lets you run a command on or pass
  arguments to multiple files'. While this tool can be used to start legitimate programs,
-  usually within the context of a batch script, it has been observed being used to evade 
-  protections on command line execution.
+  usually within the context of a batch script, it has been observed being used to
+  evade protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *"  
-    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_indirect_command_execution_via_forfiles_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles*
+  /c *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the full process path in the process field of CIM's Process data model.
  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
  Tune and filter known instances where  forfiles.exe may be used.
-known_false_positives: Some legacy applications may be run using pcalua.exe.  
-  Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
+known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly,
+  forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.
 references:
-  - https://twitter.com/KyleHanslovan/status/912659279806640128
-  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
+- https://twitter.com/KyleHanslovan/status/912659279806640128
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
 tags:
  analytic_story:
  - Living Off The Land
@@ -43,21 +43,20 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
-  - Processes.parent_process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
  - Processes.process_path
  security_domain: endpoint
  impact: 50
-  confidence: 50 
-  # (impact * confidence)/100
+  confidence: 50
  risk_score: 25
-  context: 
+  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -70,5 +69,7 @@ tags:
  - DE.AE
  cis20:
  - CIS 8
-  - CIS 10 
+  - CIS 10
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,24 +6,25 @@ author: Eric McGinnis, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic detects programs that have been started by pcalua.exe.  
-  pcalua.exe is the Microsoft Windows Program Compatability Assistant.  While this tool 
-  can be used to start legitimate programs, it has been observed being used to evade 
-  protections on command line execution.
+description: The following analytic detects programs that have been started by pcalua.exe.
+  pcalua.exe is the Microsoft Windows Program Compatability Assistant.  While this
+  tool can be used to start legitimate programs, it has been observed being used to
+  evade protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*"  
-    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_indirect_command_execution_via_pcalua_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua*
+  -a*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the full process path in the process field of CIM's Process data model.
  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
  Tune and filter known instances where pcalua.exe may be used.
-known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.  
+known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter
+  these results as needed.
 references:
-  - https://twitter.com/KyleHanslovan/status/912659279806640128
-  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
+- https://twitter.com/KyleHanslovan/status/912659279806640128
+- https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
 tags:
  analytic_story:
  - Living Off The Land
@@ -41,21 +42,20 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
-  - Processes.parent_process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
  - Processes.process_path
  security_domain: endpoint
  impact: 50
-  confidence: 50 
-  # (impact * confidence)/100
+  confidence: 50
  risk_score: 25
-  context: 
+  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -68,5 +68,7 @@ tags:
  - DE.AE
  cis20:
  - CIS 8
-  - CIS 10 
+  - CIS 10
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,24 +6,27 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies modification of Windows registry 
-  using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. 
-  This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with 
-  dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") 
-  AND Processes.process="* /s *" AND Processes.process="*.reg*" 
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_modify_registry_regedit_silent_reg_import_filter`'
+description: The following analytic identifies modification of Windows registry using
+  regedit.exe application with silent mode parameter. regedit.exe windows application
+  is commonly used as GUI app to check or modify registry. This application is also
+  has undocumented command-line parameter and one of those are silent mode parameter
+  that performs action without stopping for confirmation with dialog box. Importing
+  registry from .reg files need to monitor in a production environment since it can
+  be used adversaries to import RMS registry in compromised host.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe")
+  AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
-known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed.
+known_false_positives: Administrators may execute this command that may cause some
+  false positive. Filter as needed.
 references:
 - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
 - https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe
@@ -44,7 +47,8 @@ tags:
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: The regedit app was executed with silet mode parameter to import .reg file on $dest$.
+  message: The regedit app was executed with silet mode parameter to import .reg file
+    on $dest$.
  mitre_attack_id:
  - T1112
  nist:
@@ -72,4 +76,6 @@ tags:
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 49
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -74,3 +74,5 @@ tags:
  risk_score: 25
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,27 +6,34 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. 
-  Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. 
-  A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts.
-  The default path of mofcomp.exe is C:\Windows\System32\wbem. 
+description: The following anaytic identifies MOFComp.exe loading a MOF file. The
+  Managed Object Format (MOF) compiler parses a file containing MOF statements and
+  adds the classes and class instances defined in the file to the WMI repository.
+  Typically, MOFComp.exe does not reach out to the public internet or load a MOF file
+  from User Profile paths. A filter and consumer is typically registered in WMI. Review
+  parallel processes and query WMI subscriptions to gather artifacts. The default
+  path of mofcomp.exe is C:\Windows\System32\wbem.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where 
-  (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) 
-  OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) 
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `windows_mof_event_triggered_execution_via_wmi_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe
+  Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*"))
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present from automation based applications
+  (SCCM), filtering may be required. In addition, break the query out based on volume
+  of usage. Filter process names or f
 references:
-  - https://attack.mitre.org/techniques/T1546/003/
-  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
-  - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
-  - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/
-  - https://www.sakshamdixit.com/wmi-events/
+- https://attack.mitre.org/techniques/T1546/003/
+- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
+- https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
+- https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/
+- https://www.sakshamdixit.com/wmi-events/
 tags:
  analytic_story:
  - Living Off The Land
@@ -44,7 +51,8 @@ tags:
  impact: 80
  kill_chain_phases:
  - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ loading a MOF file.
  mitre_attack_id:
  - T1546.003
  nist:
@@ -74,14 +82,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 64
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,21 +6,25 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
+description: The following analytic identifies the usage of msiexec.exe using the
+  /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
  Upon triage, review parent process and capture any artifacts for further review.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_msiexec`
-  Processes.process IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `windows_msiexec_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
+  as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process
+  IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
 references:
-  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
 tags:
  analytic_story:
  - Windows System Binary Proxy Execution MSIExec
@@ -38,7 +42,8 @@ tags:
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to register a file.
  mitre_attack_id:
  - T1218.007
  nist:
@@ -68,14 +73,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 35
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,21 +6,25 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it.
-  During triage, review parallel processes and capture any artifacts on disk for review.
+description: The following analytic identifies msiexec.exe with http in the command-line.
+  This procedure will utilize msiexec.exe to download a remote file and load it. During
+  triage, review parallel processes and capture any artifacts on disk for review.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process IN ("*http://*", "*https://*")
-   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_msiexec_remote_download_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present, filter by destination or parent process as needed.
+  as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process
+  IN ("*http://*", "*https://*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
 references:
-  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
 tags:
  analytic_story:
  - Windows System Binary Proxy Execution MSIExec
@@ -38,7 +42,8 @@ tags:
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to download a remote file.
  mitre_attack_id:
  - T1218.007
  nist:
@@ -68,14 +73,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 35
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,20 +6,27 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies MSIExec spawning multiple discovery commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes are not common from MSIExec other than MSIExec spawning itself. 
+description: The following analytic identifies MSIExec spawning multiple discovery
+  commands, including spawning Cmd.exe or PowerShell.exe. Typically, child processes
+  are not common from MSIExec other than MSIExec spawning itself.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe")
-   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe
+  Processes.process_name IN ("powershell.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_msiexec_spawn_discovery_command_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives will be present with MSIExec spawning Cmd or
+  PowerShell. Filtering will be needed. In addition, add other known discovery processes
+  to enhance query.
 references:
-  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
 tags:
  analytic_story:
  - Windows System Binary Proxy Execution MSIExec
@@ -37,7 +44,8 @@ tags:
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ running different discovery commands.
  mitre_attack_id:
  - T1218.007
  nist:
@@ -67,14 +75,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 35
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,20 +6,25 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
+description: The following analytic identifies the usage of msiexec.exe using the
+  /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
  Upon triage, review parent process and capture any artifacts for further review.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_msiexec`
-  Processes.process IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
+  as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process
+  IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
 references:
-  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
 tags:
  analytic_story:
  - Windows System Binary Proxy Execution MSIExec
@@ -37,7 +42,8 @@ tags:
  impact: 70
  kill_chain_phases:
  - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to unregister a file.
  mitre_attack_id:
  - T1218.007
  nist:
@@ -67,14 +73,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 35
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,19 +6,23 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. 
-  An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. 
-  During triage, review parent process, parallel procesess and file modifications.  
+description: The following analytic identifies odbcconf.exe, Windows Open Database
+  Connectivity utility, utilizing the action function of regsvr to load a DLL. An
+  example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage,
+  review parent process, parallel procesess and file modifications.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe
-  Processes.process IN ("*/a *",  "*-a*") Processes.process="*regsvr*"  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `windows_odbcconf_load_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+  Processes.process IN ("*/a *",  "*-a*") Processes.process="*regsvr*"  by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
 references:
 - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
 - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
@@ -43,7 +47,8 @@ tags:
  - T1218.008
  nist:
  - DE.CM
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to circumvent controls.
  observable:
  - name: user
    type: User
@@ -69,14 +74,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 42
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,18 +6,24 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. 
-  During triage, review file modifications and parallel processes. 
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe
-  Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*"  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `windows_odbcconf_load_response_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+  Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*"  by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
 references:
 - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
 - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
@@ -42,7 +48,8 @@ tags:
  - T1218.008
  nist:
  - DE.CM
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to circumvent controls.
  observable:
  - name: user
    type: User
@@ -68,14 +75,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 42
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,24 +6,32 @@ author: Michael Haag, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document.
-  During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil.
+description: The following analytic identifies a Microsoft Office product spawning
+  the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native
+  to Windows. This behavior is related to a recently identified sample utilizing protocol
+  handlers to evade preventative controls, including if macros are disabled in the
+  document. During triage, review file modifications for html. In addition, parallel
+  processes including PowerShell and CertUtil.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
-  | `windows_office_product_spawning_msdt_filter`'
-how_to_implement: how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe")
+  Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`'
+how_to_implement: how To successfully implement this search you need to be ingesting
+  information on process that include the name of the process responsible for the
+  changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
-  - https://isc.sans.edu/diary/rss/28694
-  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
-  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
-  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
-  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
-  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+- https://isc.sans.edu/diary/rss/28694
+- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
 tags:
  analytic_story:
  - Spearphishing Attachments
@@ -44,8 +52,8 @@ tags:
  impact: 100
  kill_chain_phases:
  - Exploitation
-  message: Office parent process $parent_process_name$ has spawned a child
-    process $process_name$ on host $dest$.
+  message: Office parent process $parent_process_name$ has spawned a child process
+    $process_name$ on host $dest$.
  mitre_attack_id:
  - T1566
  - T1566.001
@@ -76,14 +84,16 @@ tags:
  - _time
  - Processes.dest
  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 100
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -76,3 +76,5 @@ tags:
  risk_score: 49
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic is to look for known processes killed by industroyer2 malware. 
-  This technique was seen in the industroyer2 malware attack that tries to kill several processes 
-  of windows host machines related to the energy facility network. This anomaly might be a good 
-  indicator to check which process kill these processes or why the process was killed.
-search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") 
-  | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
-  | `windows_processes_killed_by_industroyer2_malware_filter`'
+description: The following analytic is to look for known processes killed by industroyer2
+  malware. This technique was seen in the industroyer2 malware attack that tries to
+  kill several processes of windows host machines related to the energy facility network.
+  This anomaly might be a good indicator to check which process kill these processes
+  or why the process was killed.
+search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe")
+  | stats min(_time) as firstTime max(_time) as lastTime count by process_name process
+  process_path process_guid process_id EventCode dest user_id | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `windows_processes_killed_by_industroyer2_malware_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
  required.
 known_false_positives: False positives are possible if legitimate applications are
-  allowed to terminate this process during testing or updates. Filter as needed based on paths that
-  are used legitimately.
+  allowed to terminate this process during testing or updates. Filter as needed based
+  on paths that are used legitimately.
 references:
 - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
 tags:
@@ -69,3 +70,5 @@ tags:
  - Processes.process_guid
  risk_score: 36
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -79,3 +79,5 @@ tags:
  risk_score: 80
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,18 +6,27 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies a process attempting to delete a scheduled task SD (Security Descriptor) from within the registry path of that task.
-  This may occur from a non-standard process running and may not come from reg.exe. This particular behavior will remove the actual Task Name from the Task Scheduler GUI and from the command-line query - schtasks.exe /query. 
-  In addition, in order to perform this action, the user context will need to be SYSTEM.
+description: The following analytic identifies a process attempting to delete a scheduled
+  task SD (Security Descriptor) from within the registry path of that task. This may
+  occur from a non-standard process running and may not come from reg.exe. This particular
+  behavior will remove the actual Task Name from the Task Scheduler GUI and from the
+  command-line query - schtasks.exe /query. In addition, in order to perform this
+  action, the user context will need to be SYSTEM.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
-  where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified)
-  by _time  Registry.dest Registry.process_guid Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data Registry.status Registry.action
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `windows_registry_delete_task_sd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel.
+  where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM"
+  Registry.registry_value_name="SD" (Registry.action=Deleted OR Registry.action=modified)
+  by _time  Registry.dest Registry.process_guid Registry.user Registry.registry_path
+  Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data
+  Registry.status Registry.action | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_registry_delete_task_sd_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited as the activity is not common
+  to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified
+  or Deleted values based on product that is in the datamodel.
 references:
 - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
 - https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728
@@ -45,7 +54,7 @@ tags:
  - T1562
  nist:
  - DE.CM
-  message: A scheduled task security descriptor was deleted from the registry on $dest$. 
+  message: A scheduled task security descriptor was deleted from the registry on $dest$.
  observable:
  - name: dest
    type: Endpoint
@@ -61,10 +70,12 @@ tags:
  - Registry.registry_key_name
  - Registry.registry_value_name
  - Registry.dest
-  - Processes.process_id 
-  - Processes.process_name 
+  - Processes.process_id
+  - Processes.process_name
  - Processes.process
  - Processes.dest
-  - Processes.process_guid 
+  - Processes.process_guid
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -76,3 +76,5 @@ tags:
  risk_score: 80
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote 
-  desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries
-  to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") 
-  AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*")
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_remote_service_rdpwinst_tool_execution_filter`'
+description: The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper
+  library tool designed to enable remote desktop host support and concurrent RDP session
+  on reduced functionality system. Unfortunately, this open project was abused by
+  adversaries to enable RDP connection to the targeted host for remote access and
+  potentially be for lateral movement.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe")
+  AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
-known_false_positives: This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
+known_false_positives: This tool was designed for home usage and not commonly seen
+  in production environment. Filter as needed.
 references:
 - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
 tags:
@@ -71,4 +73,6 @@ tags:
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 81
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -7,25 +7,27 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic is to identify a modification in the Windows firewall
-  to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
-  to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some 
-  production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits 
-  of attack to start lateral movement.
+  to enable remote desktop protocol on a targeted machine. This technique was seen
+  in several adversaries, malware or red teamer to remotely access the compromised
+  or targeted host by allowing this protocol in firewall. Even this protocol might
+  be allowed in some production environment, This TTP behavior is a good pivot to
+  check who and why the user want to enable this feature through firewall which is
+  also common traits of attack to start lateral movement.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
  values(Processes.parent_process_name) as parent_process values(Processes.process_name)
  count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" 
-  AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*"
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe")
+  AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process
+  = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process
+  = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_remote_services_allow_rdp_in_firewall_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
  of the Sysmon TA.
-known_false_positives: administrators may enable or disable this feature that may cause some false positive. 
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
 references:
 - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
 tags:
@@ -72,3 +74,5 @@ tags:
  - Processes.user
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -73,3 +73,5 @@ tags:
  risk_score: 48
  security_domain: endpoint
  asset_type: Endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -4,7 +4,7 @@ version: 1
 date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
 type: TTP
-datamodel: 
+datamodel:
 - Endpoint
 description: The search looks for a Windows Security Account Manager (SAM) was stopped
  via command-line. This is consistent with Ryuk infections across a fleet of endpoints.
@@ -68,3 +68,5 @@ tags:
  - Processes.user
  risk_score: 70
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -6,17 +6,22 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifes a new kernel driver being added to Windows using sc.exe. 
-  Adding a Kernel driver is not common day to day and should be investigated to further understand the source.
+description: The following analytic identifes a new kernel driver being added to Windows
+  using sc.exe. Adding a Kernel driver is not common day to day and should be investigated
+  to further understand the source.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe
-  Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_service_create_kernel_mode_driver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present based on common applications adding new drivers, however, filter as needed.
+  Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_service_create_kernel_mode_driver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present based on common applications
+  adding new drivers, however, filter as needed.
 references:
 - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
 tags:
@@ -36,7 +41,8 @@ tags:
  impact: 60
  kill_chain_phases:
  - Installation
-  message: Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$.
+  message: Service control, $process_name$, loaded a new kernel mode driver on $dest$
+    by $user$.
  mitre_attack_id:
  - T1543.003
  - T1543
@@ -61,11 +67,13 @@ tags:
  - Processes.dest
  - Processes.user
  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 48
-  security_domain: endpoint
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -11,13 +11,13 @@ description: The following analytic identifies Windows Service Control, `sc.exe`
  instances of service enumeration of attempts to stop a service and then delete it.
  Adversaries utilize this technique to terminate security services or other related
  services to continue there objective and evade detections.
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_service_stop_by_deletion_filter`'
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe)
+  Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -73,3 +73,5 @@ tags:
  - Processes.user
  risk_score: 49
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -72,3 +72,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 56
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
@@ -73,3 +73,5 @@ tags:
  - Processes.parent_process_id
  risk_score: 30
  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
--- a/Show More
+++ b/Show More