Branch was auto-updated.

detections/deprecated/execution_of_file_with_spaces_before_extension.yml

@@ -23,6 +23,7 @@ references: []
 tags:
   analytic_story:
   - Windows File Extension and Association Abuse
+  - Masquerading - Rename System Utilities
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/anomalous_usage_of_7zip.yml

@@ -0,0 +1,56 @@
+name: Anomalous usage of 7zip
+id: 9364ee8e-a39a-11eb-8f1d-acde48001122
+version: 1
+date: '2021-04-22'
+author: Michael Haag, Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
+  or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
+  It has been observed where an adversary will rename `7z.exe`. Additional coverage
+  may be required to identify the behavior of renamed instances of `7z.exe`. During
+  triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture
+  any files written to disk and analyze as needed. Review parallel processes for additional
+  behaviors. Typically, archiving files will result in exfiltration.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited as this behavior is not normal
+  for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
+references:
+- https://attack.mitre.org/techniques/T1560/001/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
+tags:
+  analytic_story:
+  - Cobalt Strike
+  - NOBELIUM Group
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1560.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/execution_of_file_with_multiple_extensions.yml

@@ -24,6 +24,7 @@ references: []
 tags:
   analytic_story:
   - Windows File Extension and Association Abuse
+  - Masquerading - Rename System Utilities
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/office_product_spawning_bitsadmin.yml

@@ -0,0 +1,54 @@
+name: Office Product Spawning BITSAdmin
+id: e8c591f4-a6d7-11eb-8cf7-acde48001122
+version: 1
+date: '2021-04-26'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies the latest behavior utilized by different
+  malware families (including TA551, IcedID). This detection identifies any Windows
+  Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line
+  of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line
+  arguments as `/transfer /Download /priority Foreground`. In addition, Threat Research
+  has released a detections identifying suspicious use of `bitsadmin.exe`. In this
+  instance, we narrow our detection down to the Office suite as a parent process.
+  During triage, review all file modifications. Capture and analyze any artifacts
+  on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote
+  destination, capture and block the IPs or domain. Review additional parallel processes
+  for further activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=bitsadmin.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: No false positives known. Filter as needed.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/office_product_spawning_certutil.yml

@@ -0,0 +1,54 @@
+name: Office Product Spawning CertUtil
+id: 6925fe72-a6d5-11eb-9e17-acde48001122
+version: 1
+date: '2021-04-26'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies the latest behavior utilized by different
+  malware families (including TA551, IcedID). This detection identifies any Windows
+  Office Product spawning `certutil.exe`. In malicious instances, the command-line
+  of `certutil.exe` will contain a URL to a remote destination. In addition, Threat
+  Research has released a detections identifying suspicious use of `certutil.exe`.
+  In this instance, we narrow our detection down to the Office suite as a parent process.
+  During triage, review all file modifications. Capture and analyze any artifacts
+  on disk. The Office Product, or `certutil.exe` will have reached out to a remote
+  destination, capture and block the IPs or domain. Review additional parallel processes
+  for further activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=certutil.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_certutil_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: No false positives known. Filter as needed.
+references:
+- https://redcanary.com/threat-detection-report/threats/TA551/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/office_product_spawning_mshta.yml

@@ -0,0 +1,53 @@
+name: Office Product Spawning MSHTA
+id: 6078fa20-a6d2-11eb-b662-acde48001122
+version: 1
+date: '2021-04-26'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies the latest behavior utilized by different
+  malware families (including TA551, IcedID). This detection identifies any Windows
+  Office Product spawning `mshta.exe`. In malicious instances, the command-line of
+  `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination.
+  In addition, Threat Research has released a detections identifying suspicious use
+  of `mshta.exe`. In this instance, we narrow our detection down to the Office suite
+  as a parent process. During triage, review all file modifications. Capture and analyze
+  any artifacts on disk. The Office Product, or `mshta.exe` will have reached out
+  to a remote destination, capture and block the IPs or domain. Review additional
+  parallel processes for further activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=mshta.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: No false positives known. Filter as needed.
+references:
+- https://redcanary.com/threat-detection-report/threats/TA551/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/office_product_spawning_wmic.yml

@@ -0,0 +1,55 @@
+name: Office Product Spawning Wmic
+id: ffc236d6-a6c9-11eb-95f1-acde48001122
+version: 1
+date: '2021-04-26'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following detection identifies the latest behavior utilized by Ursnif
+  malware family. This detection identifies any Windows Office Product spawning `wmic.exe`.
+  In malicious instances, the command-line of `wmic.exe` will contain `wmic process
+  call create`. In addition, Threat Research has released a detection identifying
+  the use of `wmic process call create` on the command-line of `wmic.exe`. In this
+  instance, we narrow our detection down to the Office suite as a parent process.
+  During triage, review all file modifications. Capture and analyze any artifacts
+  on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination,
+  capture and block the IPs or domain. Review additional parallel processes for further
+  activity.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=wmic.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: No false positives known. Filter as needed.
+references:
+- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
+- https://attack.mitre.org/techniques/T1047/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - process_id
+  - parent_process_name
+  - dest
+  - user
+  - parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/ssa___system_process_running_unexpected_location.yml

@@ -233,6 +233,7 @@ references: []
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Masquerading - Rename System Utilities
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
   cis20:

detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution
   - Cobalt Strike
+  - Masquerading - Rename System Utilities
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/suspicious_msbuild_path.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
   - Cobalt Strike
+  - Masquerading - Rename System Utilities
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/suspicious_msbuild_rename.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
   - Cobalt Strike
+  - Masquerading - Rename System Utilities
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/suspicious_rundll32_rename.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
+  - Masquerading - Rename System Utilities
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/system_processes_run_from_unexpected_locations.yml

@@ -1,29 +1,36 @@
 name: System Processes Run From Unexpected Locations
 id: a34aae96-ccf8-4aef-952c-3ea21444444d
-version: 5
+version: 6
 date: '2020-12-08'
-author: David Dorsey, Splunk
+author: David Dorsey, Michael Haag, Splunk
 type: batch
-datamodel: []
-description: This search looks for system processes that normally run out of C:\Windows\System32\
-  or C:\Windows\SysWOW64 that are not run from that location.  This can indicate a
-  malicious process that is trying to hide as a legitimate process.
+datamodel:
+  - Endpoint
+description: 'This search looks for system processes that typically execute from `C:\Windows\System32\`
+  or `C:\Windows\SysWOW64`.  This may indicate a malicious process that is trying to hide as a legitimate process.\
+  
+  This detection utilizes a lookup that is deduped `system32` and `syswow64` directories from Server 2016 and Windows 10.\
+  
+  During triage, review the parallel processes - what process moved the native Windows binary? identify any artifacts on disk and review. If a remote destination is contacted, what is the reputation?'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
-  Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest
-  Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name
-  Processes.process_hash| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
+  Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)`| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter`'
-how_to_implement: To successfully implement this search you need to ingest details
-  about process execution from your hosts. Specifically, this search requires the
-  process name and the full path to the process executable.
-known_false_positives: None identified
-references: []
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths. 
+references: 
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+  - https://attack.mitre.org/techniques/T1036/003/
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
   - Unusual Processes
   - Ransomware
+  - Masquerading - Rename System Utilities
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

lookups/is_windows_system_file.csv

@@ -1,244 +1,53 @@
 filename,systemFile
-arp.exe,true
-adaptertroubleshooter.exe,true
-applicationframehost.exe,true
-atbroker.exe,true
-authhost.exe,true
-autoworkplace.exe,true
-axinstui.exe,true
-backgroundtransferhost.exe,true
-bdehdcfg.exe,true
-bdeuisrv.exe,true
-bdeunlockwizard.exe,true
-bitlockerdeviceencryption.exe,true
-bitlockerwizard.exe,true
-bitlockerwizardelev.exe,true
-bytecodegenerator.exe,true
-camerasettingsuihost.exe,true
-castsrv.exe,true
-certenrollctrl.exe,true
-checknetisolation.exe,true
-clipup.exe,true
-cloudexperiencehostbroker.exe,true
-cloudnotifications.exe,true
-cloudstoragewizard.exe,true
-compmgmtlauncher.exe,true
-compattelrunner.exe,true
-computerdefaults.exe,true
-credentialuibroker.exe,true
-dfdwiz.exe,true
-dwwin.exe,true
-dataexchangehost.exe,true
-defrag.exe,true
-devicedisplayobjectprovider.exe,true
-deviceeject.exe,true
-deviceenroller.exe,true
-devicepairingwizard.exe,true
-deviceproperties.exe,true
-disksnapshot.exe,true
-dism.exe,true
-displayswitch.exe,true
-dmnotificationbroker.exe,true
-dmomacpmo.exe,true
-dpiscaling.exe,true
-dsmusertask.exe,true
-dxpserver.exe,true
-edpcleanup.exe,true
-eosnotify.exe,true
-eap3host.exe,true
-easpoliciesbrokerhost.exe,true
-easeofaccessdialog.exe,true
-ehstorauthn.exe,true
-fxscover.exe,true
-fxssvc.exe,true
-fxsunatd.exe,true
-filehistory.exe,true
-fondue.exe,true
-gamepanel.exe,true
-genvalobj.exe,true
-gettingstarted.exe,true
-hostname.exe,true
-icsentitlementhost.exe,true
-infdefaultinstall.exe,true
-installagent.exe,true
-languagecomponentsinstallercomhandler.exe,true
-launchtm.exe,true
-launchwinapp.exe,true
-legacynetuxhost.exe,true
-licensemanagershellext.exe,true
-licensingui.exe,true
-locationnotificationwindows.exe,true
-locationnotifications.exe,true
-locator.exe,true
-lockapphost.exe,true
-lockscreencontentserver.exe,true
-logonui.exe,true
-lsaiso.exe,true
-mdeserver.exe,true
-mdmagent.exe,true
-mdmappinstaller.exe,true
-mrinfo.exe,true
-mrt.exe,true
-mschedexe.exe,true
-magnify.exe,true
-mbaeparsertask.exe,true
-mdres.exe,true
-mdsched.exe,true
-migautoplay.exe,true
-mpsigstub.exe,true
-msspellcheckinghost.exe,true
-muiunattend.exe,true
-multidigimon.exe,true
-musnotification.exe,true
-musnotificationux.exe,true
-napstat.exe,true
-netstat.exe,true
-narrator.exe,true
-netcfgnotifyobjecthost.exe,true
-netevtfwdr.exe,true
-netproj.exe,true
-netplwiz.exe,true
-networkuxbroker.exe,true
-openwith.exe,true
-optionalfeatures.exe,true
-pathping.exe,true
-ping.exe,true
-passwordonwakesettingflyout.exe,true
-pickerhost.exe,true
-pkgmgr.exe,true
-pnpunattend.exe,true
-pnputil.exe,true
-presentationhost.exe,true
-presentationsettings.exe,true
-printbrmui.exe,true
-printdialoghost.exe,true
-printdialoghost3d.exe,true
-printisolationhost.exe,true
-proximityuxhost.exe,true
-rdspnf.exe,true
-rmactivate.exe,true
-rmactivate_isv.exe,true
-rmactivate_ssp.exe,true
-rmactivate_ssp_isv.exe,true
-route.exe,true
-rdpsa.exe,true
-rdpsaproxy.exe,true
-rdpsauachelper.exe,true
-reagentc.exe,true
-recoverydrive.exe,true
-register-cimprovider.exe,true
-registeriepkeys.exe,true
-relpost.exe,true
-remoteposworker.exe,true
-rmclient.exe,true
-robocopy.exe,true
-rpcping.exe,true
-runlegacycplelevated.exe,true
-runtimebroker.exe,true
-sihclient.exe,true
-searchfilterhost.exe,true
-searchindexer.exe,true
-searchprotocolhost.exe,true
-secedit.exe,true
-sensordataservice.exe,true
-setieinstalleddate.exe,true
-settingsynchost.exe,true
-slidetoshutdown.exe,true
-smartscreensettings.exe,true
-sndvol.exe,true
-snippingtool.exe,true
-soundrecorder.exe,true
-spaceagent.exe,true
-sppextcomobj.exe,true
-srtasks.exe,true
-stikynot.exe,true
-synchost.exe,true
-sysreseterr.exe,true
-systempropertiesadvanced.exe,true
-systempropertiescomputername.exe,true
-systempropertiesdataexecutionprevention.exe,true
-systempropertieshardware.exe,true
-systempropertiesperformance.exe,true
-systempropertiesprotection.exe,true
-systempropertiesremote.exe,true
-systemsettingsadminflows.exe,true
-systemsettingsbroker.exe,true
-systemsettingsremovedevice.exe,true
-tcpsvcs.exe,true
-tracert.exe,true
-tstheme.exe,true
-tswbprxy.exe,true
-tapiunattend.exe,true
-taskmgr.exe,true
-thumbnailextractionhost.exe,true
-tokenbrokercookies.exe,true
-tpminit.exe,true
-tswpfwrp.exe,true
-ui0detect.exe,true
-upgraderesultsui.exe,true
-useraccountbroker.exe,true
-useraccountcontrolsettings.exe,true
-usoclient.exe,true
-utilman.exe,true
-vssvc.exe,true
-vaultcmd.exe,true
-vaultsysui.exe,true
-wfs.exe,true
-wmpdmc.exe,true
-wpdshextautoplay.exe,true
-wscollect.exe,true
-wsmanhttpconfig.exe,true
-wsreset.exe,true
-wudfhost.exe,true
-wwahost.exe,true
-wallpaperhost.exe,true
-webcache.exe,true
-werfault.exe,true
-werfaultsecure.exe,true
-winsat.exe,true
-windows.media.backgroundplayback.exe,true
-windowsactiondialog.exe,true
-windowsanytimeupgrade.exe,true
-windowsanytimeupgraderesults.exe,true
-windowsanytimeupgradeui.exe,true
-windowsupdateelevatedinstaller.exe,true
-workfolders.exe,true
-wpcmon.exe,true
 acu.exe,true
-aitagent.exe,true
+AgentService.exe,true
 aitstatic.exe,true
 alg.exe,true
+AppHostRegistrationVerifier.exe,true
 appidcertstorecheck.exe,true
 appidpolicyconverter.exe,true
+appidtel.exe,true
+ApplicationFrameHost.exe,true
+ApplySettingsTemplateCatalog.exe,true
+AppVClient.exe,true
+AppVDllSurrogate.exe,true
+AppVNice.exe,true
+AppVStreamingUX.exe,true
+ARP.EXE,true
 at.exe,true
+AtBroker.exe,true
 attrib.exe,true
 audiodg.exe,true
 auditpol.exe,true
+AuthHost.exe,true
 autochk.exe,true
 autoconv.exe,true
 autofmt.exe,true
-baaupdate.exe,true
-backgroundtaskhost.exe,true
+AxInstUI.exe,true
+backgroundTaskHost.exe,true
+BackgroundTransferHost.exe,true
 bcastdvr.exe,true
 bcdboot.exe,true
 bcdedit.exe,true
-bdechangepin.exe,true
-bdeunlock.exe,true
+BioIso.exe,true
 bitsadmin.exe,true
 bootcfg.exe,true
 bootim.exe,true
-bootsect.exe,true
 bridgeunattend.exe,true
 browser_broker.exe,true
 bthudtask.exe,true
+ByteCodeGenerator.exe,true
 cacls.exe,true
 calc.exe,true
-cdpreference.exe,true
+CameraSettingsUIHost.exe,true
+CastSrv.exe,true
+CertEnrollCtrl.exe,true
 certreq.exe,true
 certutil.exe,true
 change.exe,true
 changepk.exe,true
 charmap.exe,true
+CheckNetIsolation.exe,true
 chglogon.exe,true
 chgport.exe,true
 chgusr.exe,true
@@ -249,6 +58,10 @@ cipher.exe,true
 cleanmgr.exe,true
 cliconfg.exe,true
 clip.exe,true
+ClipUp.exe,true
+CloudExperienceHostBroker.exe,true
+CloudNotifications.exe,true
+CloudStorageWizard.exe,true
 cmd.exe,true
 cmdkey.exe,true
 cmdl32.exe,true
@@ -258,50 +71,82 @@ cofire.exe,true
 colorcpl.exe,true
 comp.exe,true
 compact.exe,true
+CompatTelRunner.exe,true
+CompMgmtLauncher.exe,true
+ComputerDefaults.exe,true
+Configure-SMRemoting.exe,true
 conhost.exe,true
 consent.exe,true
 control.exe,true
 convert.exe,true
+CredentialUIBroker.exe,true
 credwiz.exe,true
 cscript.exe,true
 csrss.exe,true
 ctfmon.exe,true
 cttune.exe,true
 cttunesvr.exe,true
-dashost.exe,true
+dasHost.exe,true
+DataExchangeHost.exe,true
+DataSenseLiveTileTask.exe,true
 dccw.exe,true
+dcgpofix.exe,true
 dcomcnfg.exe,true
+dcpromo.exe,true
 ddodiag.exe,true
+Defrag.exe,true
+DeviceCensus.exe,true
+DeviceEject.exe,true
+DeviceEnroller.exe,true
+DevicePairingWizard.exe,true
+DeviceProperties.exe,true
+DFDWiz.exe,true
 dfrgui.exe,true
+dfsrdiag.exe,true
 dialer.exe,true
-diantz.exe,true
-dinotify.exe,true
+DIMC.exe,true
 diskpart.exe,true
 diskperf.exe,true
 diskraid.exe,true
+diskshadow.exe,true
+DiskSnapshot.exe,true
+Dism.exe,true
 dispdiag.exe,true
+DisplaySwitch.exe,true
 djoin.exe,true
 dllhost.exe,true
 dllhst3g.exe,true
 dmcertinst.exe,true
 dmcfghost.exe,true
-dmclient.exe,true
+DmNotificationBroker.exe,true
+DmOmaCpMo.exe,true
 dnscacheugc.exe,true
 doskey.exe,true
 dpapimig.exe,true
+DpiScaling.exe,true
 dpnsvr.exe,true
 driverquery.exe,true
 drvcfg.exe,true
 drvinst.exe,true
+DsmUserTask.exe,true
 dsregcmd.exe,true
 dstokenclean.exe,true
 dvdplay.exe,true
-dvdupgrd.exe,true
 dwm.exe,true
+DWWIN.EXE,true
 dxdiag.exe,true
+Dxpserver.exe,true
+Eap3Host.exe,true
+EaseOfAccessDialog.exe,true
 easinvoker.exe,true
+EasPoliciesBrokerHost.exe,true
+EDPCleanup.exe,true
+edpnotify.exe,true
 efsui.exe,true
+EhStorAuthn.exe,true
 embeddedapplauncher.exe,true
+EmbeddedAppLauncherConfig.exe,true
+escUnattend.exe,true
 esentutl.exe,true
 eudcedit.exe,true
 eventcreate.exe,true
@@ -309,13 +154,13 @@ eventvwr.exe,true
 expand.exe,true
 extrac32.exe,true
 fc.exe,true
-fhmanagew.exe,true
 find.exe,true
 findstr.exe,true
 finger.exe,true
 fixmapi.exe,true
-fltmc.exe,true
+fltMC.exe,true
 fodhelper.exe,true
+Fondue.exe,true
 fontdrvhost.exe,true
 fontview.exe,true
 forfiles.exe,true
@@ -323,8 +168,9 @@ fsavailux.exe,true
 fsquirt.exe,true
 fsutil.exe,true
 ftp.exe,true
-fvenotify.exe,true
-fveprompt.exe,true
+GameBarPresenceWriter.exe,true
+GamePanel.exe,true
+GenValObj.exe,true
 getmac.exe,true
 gpresult.exe,true
 gpscript.exe,true
@@ -332,45 +178,78 @@ gpupdate.exe,true
 grpconv.exe,true
 hdwwiz.exe,true
 help.exe,true
+HOSTNAME.EXE,true
+hvax64.exe,true
+hvix64.exe,true
+hvloader.exe,true
 hwrcomp.exe,true
 hwrreg.exe,true
+iashost.exe,true
 icacls.exe,true
-icardagt.exe,true
+IcsEntitlementHost.exe,true
 icsunattend.exe,true
 ie4uinit.exe,true
-ieunatt.exe,true
-ieetwcollector.exe,true
+ieUnatt.exe,true
 iexpress.exe,true
 immersivetpmvscmgrsvr.exe,true
+InfDefaultInstall.exe,true
+InstallAgent.exe,true
+InstallAgentUserBroker.exe,true
 ipconfig.exe,true
-irftp.exe,true
 iscsicli.exe,true
 iscsicpl.exe,true
 isoburn.exe,true
 klist.exe,true
 ksetup.exe,true
 ktmutil.exe,true
+ktpass.exe,true
 label.exe,true
+LanguageComponentsInstallerComHandler.exe,true
+LaunchTM.exe,true
+LaunchWinApp.exe,true
+LbfoAdmin.exe,true
+LegacyNetUXHost.exe,true
+LicenseManagerShellext.exe,true
 licensingdiag.exe,true
+LicensingUI.exe,true
+LocationNotificationWindows.exe,true
+Locator.exe,true
+LockAppHost.exe,true
+LockScreenContentServer.exe,true
 lodctr.exe,true
 logagent.exe,true
 logman.exe,true
 logoff.exe,true
+LogonUI.exe,true
 lpkinstall.exe,true
 lpksetup.exe,true
 lpremove.exe,true
+LsaIso.exe,true
 lsass.exe,true
-lsm.exe,true
+Magnify.exe,true
 makecab.exe,true
-manage-bde.exe,true
+mavinject.exe,true
+MbaeParserTask.exe,true
 mblctr.exe,true
 mcbuilder.exe,true
-mctadmin.exe,true
+MDEServer.exe,true
+MDMAgent.exe,true
+MDMAppInstaller.exe,true
+MdmDiagnosticsTool.exe,true
+MdRes.exe,true
+MdSched.exe,true
 mfpmp.exe,true
+Microsoft.Uev.CscUnpinTool.exe,true
+Microsoft.Uev.SyncController.exe,true
 mmc.exe,true
 mobsync.exe,true
 mountvol.exe,true
 mpnotify.exe,true
+MpSigStub.exe,true
+MRINFO.EXE,true
+MRT-KB890830.exe,true
+MRT.exe,true
+MSchedExe.exe,true
 msconfig.exe,true
 msdt.exe,true
 msdtc.exe,true
@@ -380,46 +259,70 @@ mshta.exe,true
 msiexec.exe,true
 msinfo32.exe,true
 mspaint.exe,true
-msra.exe,true
+MsSpellCheckingHost.exe,true
 mstsc.exe,true
 mtstocom.exe,true
+MuiUnattend.exe,true
+MultiDigiMon.exe,true
+MusNotification.exe,true
+MusNotificationUx.exe,true
+Narrator.exe,true
 nbtstat.exe,true
 ndadmin.exe,true
 net.exe,true
 net1.exe,true
 netbtugc.exe,true
 netcfg.exe,true
+NetCfgNotifyObjectHost.exe,true
+netdom.exe,true
+NetEvtFwdr.exe,true
+NetHost.exe,true
 netiougc.exe,true
+Netplwiz.exe,true
 netsh.exe,true
+NETSTAT.EXE,true
 newdev.exe,true
 nltest.exe,true
 notepad.exe,true
 nslookup.exe,true
 ntoskrnl.exe,true
 ntprint.exe,true
-ocsetup.exe,true
 odbcad32.exe,true
 odbcconf.exe,true
 omadmclient.exe,true
 omadmprc.exe,true
 openfiles.exe,true
+OpenWith.exe,true
+OptionalFeatures.exe,true
 osk.exe,true
-p2phost.exe,true
+PackagedCWALauncher.exe,true
+PackageInspector.exe,true
+PasswordOnWakeSettingFlyout.exe,true
+PATHPING.EXE,true
 pcalua.exe,true
 pcaui.exe,true
-pcawrk.exe,true
 pcwrun.exe,true
 perfmon.exe,true
 phoneactivate.exe,true
+PickerHost.exe,true
+PING.EXE,true
+PkgMgr.exe,true
 plasrv.exe,true
+PnPUnattend.exe,true
+pnputil.exe,true
 poqexec.exe,true
 powercfg.exe,true
+PresentationHost.exe,true
+PresentationSettings.exe,true
 prevhost.exe,true
 print.exe,true
+PrintBrmUi.exe,true
+PrintDialogHost.exe,true
+PrintDialogHost3D.exe,true
 printfilterpipelinesvc.exe,true
+PrintIsolationHost.exe,true
 printui.exe,true
 proquota.exe,true
-provtool.exe,true
 psr.exe,true
 pwlauncher.exe,true
 qappsrv.exe,true
@@ -427,105 +330,174 @@ qprocess.exe,true
 query.exe,true
 quser.exe,true
 qwinsta.exe,true
-rasautou.exe,true
 rasdial.exe,true
-raserver.exe,true
-rasphone.exe,true
 rdpclip.exe,true
+rdpinit.exe,true
 rdpinput.exe,true
+RdpSa.exe,true
+RdpSaProxy.exe,true
+RdpSaUacHelper.exe,true
+rdpshell.exe,true
+rdpsign.exe,true
 rdrleakdiag.exe,true
-recdisc.exe,true
+RDSPnf.exe,true
+ReAgentc.exe,true
 recover.exe,true
+RecoveryDrive.exe,true
 reg.exe,true
 regedt32.exe,true
 regini.exe,true
+Register-CimProvider.exe,true
 regsvr32.exe,true
 rekeywiz.exe,true
 relog.exe,true
-repair-bde.exe,true
+RelPost.exe,true
+RemotePosWorker.exe,true
 replace.exe,true
 reset.exe,true
+ResetEngine.exe,true
 resmon.exe,true
+RMActivate.exe,true
+RMActivate_isv.exe,true
+RMActivate_ssp.exe,true
+RMActivate_ssp_isv.exe,true
+RmClient.exe,true
 rmttpmvscmgrsvr.exe,true
+Robocopy.exe,true
+ROUTE.EXE,true
+RpcPing.exe,true
 rrinstaller.exe,true
-rstrui.exe,true
+rsopprov.exe,true
 runas.exe,true
 rundll32.exe,true
+RunLegacyCPLElevated.exe,true
 runonce.exe,true
+RuntimeBroker.exe,true
 rwinsta.exe,true
-sbunattend.exe,true
+sacsess.exe,true
 sc.exe,true
 schtasks.exe,true
+ScriptRunner.exe,true
 sdbinst.exe,true
-sdchange.exe,true
-sdclt.exe,true
 sdiagnhost.exe,true
+SearchFilterHost.exe,true
+SearchIndexer.exe,true
+SearchProtocolHost.exe,true
+SecEdit.exe,true
 secinit.exe,true
+securekernel.exe,true
+SensorDataService.exe,true
+ServerManager.exe,true
+ServerManagerLauncher.exe,true
 services.exe,true
 sessionmsg.exe,true
 sethc.exe,true
+setres.exe,true
 setspn.exe,true
+SettingSyncHost.exe,true
 setupcl.exe,true
 setupugc.exe,true
 setx.exe,true
 sfc.exe,true
-shadow.exe,true
 shrpubw.exe,true
 shutdown.exe,true
 sigverif.exe,true
+SIHClient.exe,true
 sihost.exe,true
+SlideToShutDown.exe,true
 slui.exe,true
+smartscreen.exe,true
+SmartScreenSettings.exe,true
 smss.exe,true
+SndVol.exe,true
+SnippingTool.exe,true
 snmptrap.exe,true
 sort.exe,true
-spinstall.exe,true
+SpaceAgent.exe,true
+spaceman.exe,true
 spoolsv.exe,true
+SppExtComObj.Exe,true
 sppsvc.exe,true
-spreview.exe,true
-srdelayed.exe,true
+stordiag.exe,true
 subst.exe,true
 svchost.exe,true
 sxstrace.exe,true
+SyncAppvPublishingServer.exe,true
+SyncHost.exe,true
 syskey.exe,true
+SysResetErr.exe,true
 systeminfo.exe,true
+SystemPropertiesAdvanced.exe,true
+SystemPropertiesComputerName.exe,true
+SystemPropertiesDataExecutionPrevention.exe,true
+SystemPropertiesHardware.exe,true
+SystemPropertiesPerformance.exe,true
+SystemPropertiesProtection.exe,true
+SystemPropertiesRemote.exe,true
 systemreset.exe,true
+SystemSettingsAdminFlows.exe,true
+SystemSettingsBroker.exe,true
+SystemSettingsRemoveDevice.exe,true
 systray.exe,true
 tabcal.exe,true
 takeown.exe,true
-taskeng.exe,true
-taskhost.exe,true
+TapiUnattend.exe,true
 taskhostw.exe,true
 taskkill.exe,true
 tasklist.exe,true
-taskmgr.exe,true
+Taskmgr.exe,true
 tcmsetup.exe,true
+TCPSVCS.EXE,true
+tdlrecover.exe,true
+ThumbnailExtractionHost.exe,true
+TieringEngineService.exe,true
 timeout.exe,true
+TokenBrokerCookies.exe,true
+TpmInit.exe,true
 tpmvscmgr.exe,true
 tpmvscmgrsvr.exe,true
 tracerpt.exe,true
+TRACERT.EXE,true
 tscon.exe,true
 tsdiscon.exe,true
+tsecimp.exe,true
 tskill.exe,true
+TSTheme.exe,true
+TSWbPrxy.exe,true
 typeperf.exe,true
 tzsync.exe,true
 tzutil.exe,true
 ucsvc.exe,true
+UevAgentPolicyGenerator.exe,true
+UevAppMonitor.exe,true
+UevTemplateBaselineGenerator.exe,true
+UevTemplateConfigItemGenerator.exe,true
+UI0Detect.exe,true
 unlodctr.exe,true
 unregmp2.exe,true
+UpgradeResultsUI.exe,true
 upnpcont.exe,true
+UserAccountBroker.exe,true
+UserAccountControlSettings.exe,true
 userinit.exe,true
+UsoClient.exe,true
+Utilman.exe,true
+VaultCmd.exe,true
 vds.exe,true
 vdsldr.exe,true
 verclsid.exe,true
 verifier.exe,true
 verifiergui.exe,true
-vmicsvc.exe,true
 vssadmin.exe,true
+VSSUIRUN.exe,true
+VSSVC.exe,true
 w32tm.exe,true
 waitfor.exe,true
-wbadmin.exe,true
-wbengine.exe,true
+WallpaperHost.exe,true
+WebCache.exe,true
 wecutil.exe,true
+WerFault.exe,true
+WerFaultSecure.exe,true
 wermgr.exe,true
 wevtutil.exe,true
 wextract.exe,true
@@ -533,31 +505,249 @@ where.exe,true
 whoami.exe,true
 wiaacmgr.exe,true
 wiawow64.exe,true
-wifitask.exe,true
 wimserv.exe,true
+win32calc.exe,true
+WinBioDataModelOOBE.exe,true
+Windows.Media.BackgroundPlayback.exe,true
+WindowsActionDialog.exe,true
+WindowsUpdateElevatedInstaller.exe,true
 wininit.exe,true
 winload.exe,true
 winlogon.exe,true
 winresume.exe,true
 winrs.exe,true
 winrshost.exe,true
+WinSAT.exe,true
 winver.exe,true
-wisptis.exe,true
 wkspbroker.exe,true
 wksprt.exe,true
-wlanext.exe,true
 wlrmdr.exe,true
+WMPDMC.exe,true
 wowreg32.exe,true
-wpnpinst.exe,true
+WPDShextAutoplay.exe,true
 wpr.exe,true
 write.exe,true
+WSCollect.exe,true
 wscript.exe,true
+WSManHTTPConfig.exe,true
 wsmprovhost.exe,true
 wsqmcons.exe,true
+WSReset.exe,true
 wuapihost.exe,true
-wuapp.exe,true
 wuauclt.exe,true
+WUDFHost.exe,true
 wusa.exe,true
+WWAHost.exe,true
+XblGameSaveTask.exe,true
 xcopy.exe,true
-xpsrchvw.exe,true
 xwizard.exe,true
+comrepl.exe,true
+MigRegDB.exe,true
+DiagnosticsHub.StandardCollector.Service.exe,true
+DismHost.exe,true
+F12Chooser.exe,true
+IMJPDCT.EXE,true
+IMJPSET.EXE,true
+IMJPUEX.EXE,true
+imjpuexc.exe,true
+IMTCLNWZ.EXE,true
+IMTCPROP.exe,true
+IMCCPHR.exe,true
+ImeBroker.exe,true
+imecfmui.exe,true
+IMEDICTUPDATEUI.EXE,true
+IMEPADSV.EXE,true
+IMESEARCH.EXE,true
+IMEWDBLD.EXE,true
+ChsIME.exe,true
+ChtIME.exe,true
+mighost.exe,true
+audit.exe,true
+AuditShD.exe,true
+FirstLogonAnim.exe,true
+msoobe.exe,true
+oobeldr.exe,true
+Setup.exe,true
+UserOOBEBroker.exe,true
+windeploy.exe,true
+SpeechUXWiz.exe,true
+SpeechModelDownload.exe,true
+SpeechRuntime.exe,true
+PrintBrm.exe,true
+PrintBrmEngine.exe,true
+sysprep.exe,true
+SystemResetPlatform.exe,true
+mofcomp.exe,true
+scrcons.exe,true
+unsecapp.exe,true
+wbemtest.exe,true
+WinMgmt.exe,true
+WMIADAP.exe,true
+WmiApSrv.exe,true
+WMIC.exe,true
+WmiPrvSE.exe,true
+powershell.exe,true
+powershell_ise.exe,true
+dplaysvr.exe,true
+dtdump.exe,true
+hh.exe,true
+instnm.exe,true
+perfhost.exe,true
+rasautou.exe,true
+rasphone.exe,true
+regedit.exe,true
+setup16.exe,true
+user.exe,true
+_isdel.exe,true
+agentactivationruntimestarter.exe,true
+ApplyTrustOffline.exe,true
+ApproveChildRequest.exe,true
+appverif.exe,true
+baaupdate.exe,true
+bash.exe,true
+bdechangepin.exe,true
+BdeHdCfg.exe,true
+BdeUISrv.exe,true
+bdeunlock.exe,true
+BitLockerDeviceEncryption.exe,true
+BitLockerWizard.exe,true
+BitLockerWizardElev.exe,true
+bootsect.exe,true
+browserexport.exe,true
+CIDiag.exe,true
+CompPkgSrv.exe,true
+convertvhd.exe,true
+coredpussvr.exe,true
+CredentialEnrollmentManager.exe,true
+curl.exe,true
+CustomInstallExec.exe,true
+d3dconfig.exe,true
+DataStoreCacheDumpTool.exe,true
+DataUsageLiveTileTask.exe,true
+deploymentcsphelper.exe,true
+desktopimgdownldr.exe,true
+DeviceCredentialDeployment.exe,true
+directxdatabaseupdater.exe,true
+dmclient.exe,true
+DTUHandler.exe,true
+dusmtask.exe,true
+DXCap.exe,true
+DXCpl.exe,true
+dxgiadaptercache.exe,true
+EASPolicyManagerBrokerHost.exe,true
+EduPrintProv.exe,true
+EoAExperiences.exe,true
+fhmanagew.exe,true
+FileHistory.exe,true
+FsIso.exe,true
+fvenotify.exe,true
+fveprompt.exe,true
+FXSCOVER.exe,true
+FXSSVC.exe,true
+FXSUNATD.exe,true
+hcsdiag.exe,true
+hnsdiag.exe,true
+hvsievaluator.exe,true
+ie4ushowIE.exe,true
+IESettingSync.exe,true
+InputSwitchToastHandler.exe,true
+iotstartup.exe,true
+manage-bde.exe,true
+MBR2GPT.EXE,true
+microsoft.windows.softwarelogo.showdesktop.exe,true
+MicrosoftEdgeBCHost.exe,true
+MicrosoftEdgeCP.exe,true
+MicrosoftEdgeDevTools.exe,true
+MicrosoftEdgeSH.exe,true
+mmgaserver.exe,true
+MoUsoCoreWorker.exe,true
+msra.exe,true
+MusNotifyIcon.exe,true
+NDKPing.exe,true
+NgcIso.exe,true
+nmbind.exe,true
+nmscrub.exe,true
+nvspinfo.exe,true
+ofdeploy.exe,true
+pacjsworker.exe,true
+PinEnrollmentBroker.exe,true
+PktMon.exe,true
+pospaymentsworker.exe,true
+provlaunch.exe,true
+provtool.exe,true
+ProximityUxHost.exe,true
+prproc.exe,true
+quickassist.exe,true
+raserver.exe,true
+RDVGHelper.exe,true
+recdisc.exe,true
+refsutil.exe,true
+RemoteAppLifetimeManager.exe,true
+RemoteFXvGPUDisablement.exe,true
+repair-bde.exe,true
+rstrui.exe,true
+runexehelper.exe,true
+sdchange.exe,true
+sdclt.exe,true
+SecurityHealthHost.exe,true
+SecurityHealthService.exe,true
+SecurityHealthSystray.exe,true
+SgrmBroker.exe,true
+SgrmLpac.exe,true
+SpatialAudioLicenseSrv.exe,true
+Spectrum.exe,true
+srdelayed.exe,true
+SrTasks.exe,true
+SystemUWPLauncher.exe,true
+tar.exe,true
+tcblaunch.exe,true
+TpmTool.exe,true
+ttdinject.exe,true
+tttracer.exe,true
+UIMgrBroker.exe,true
+upfc.exe,true
+usocoreworker.exe,true
+UtcDecoderHost.exe,true
+VBoxControl.exe,true
+VBoxService.exe,true
+VBoxTray.exe,true
+vfpctrl.exe,true
+vmcompute.exe,true
+vmwp.exe,true
+VsGraphicsDesktopEngine.exe,true
+VsGraphicsRemoteEngine.exe,true
+vsjitdebugger.exe,true
+WaaSMedicAgent.exe,true
+wbadmin.exe,true
+wbengine.exe,true
+WFS.exe,true
+wifitask.exe,true
+Windows.WARP.JITService.exe,true
+WinRTNetMUAHostServer.exe,true
+wlanext.exe,true
+WorkFolders.exe,true
+WpcMon.exe,true
+WpcTok.exe,true
+wpnpinst.exe,true
+wscadminui.exe,true
+wsl.exe,true
+wslconfig.exe,true
+WUDFCompanionHost.exe,true
+IEChooser.exe,true
+wslhost.exe,true
+scp.exe,true
+sftp.exe,true
+ssh-add.exe,true
+ssh-agent.exe,true
+ssh-keygen.exe,true
+ssh-keyscan.exe,true
+ssh.exe,true
+PerceptionSimulationInput.exe,true
+PerceptionSimulationService.exe,true
+UNPUXHost.exe,true
+UNPUXLauncher.exe,true
+UpdateNotificationMgr.exe,true
+FaceFodUninstaller.exe,true
+wlms.exe,true
+OneDriveSetup.exe,true
+OposHost.exe,true

lookups/is_windows_system_file.yml

@@ -1,5 +1,5 @@
 default_match: 'false'
-description: A list of executable files in Windows\System32
+description: A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
 filename: is_windows_system_file.csv
 min_matches: 1
 name: is_windows_system_file

stories/masquerading___rename_system_utilities.yml

@@ -0,0 +1,26 @@
+name: 'Masquerading - Rename System Utilities'
+id: f0258af4-a6ae-11eb-b3c2-acde48001122
+version: 1
+date: '2021-04-26'
+author: Michael Haag, Splunk
+type: batch
+description: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.
+narrative: 'Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. 
+  It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). 
+  An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.\
+
+  The following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\
+  
+  There will be false positives as some native Windows processes are moved or ran by third party applications from different paths. If file names are mismatched between the file name on disk and that of the binarys PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.'
+references:
+- https://attack.mitre.org/techniques/T1036/003/
+tags:
+  analytic_story:
+  - Masquerading - Rename System Utilities
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/anomalous_usage_of_7zip.test.yml

@@ -0,0 +1,12 @@
+name: Anomalous usage of 7zip Unit Test
+tests:
+- name: Anomalous usage of 7zip
+  file: endpoint/anomalous_usage_of_7zip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_product_spawning_bitsadmin.test.yml

@@ -0,0 +1,12 @@
+name: Office Product Spawning BITSAdmin Unit Test
+tests:
+- name: Office Product Spawning BITSAdmin
+  file: endpoint/office_product_spawning_bitsadmin.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_macros.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_product_spawning_certutil.test.yml

@@ -0,0 +1,12 @@
+name: Office Product Spawning CertUtil Unit Test
+tests:
+- name: Office Product Spawning CertUtil
+  file: endpoint/office_product_spawning_certutil.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_macros.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_product_spawning_mshta.test.yml

@@ -0,0 +1,12 @@
+name: Office Product Spawning MSHTA Unit Test
+tests:
+- name: Office Product Spawning MSHTA
+  file: endpoint/office_product_spawning_mshta.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_macros.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/office_product_spawning_wmic.test.yml

@@ -0,0 +1,12 @@
+name: Office Product Spawning Wmic Unit Test
+tests:
+- name: Office Product Spawning Wmic
+  file: endpoint/office_product_spawning_wmic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon_macros.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog