Branch was auto-updated.

detections/endpoint/impacket_lateral_movement_commandline_parameters.yml

@@ -1,7 +1,7 @@
 name: Impacket Lateral Movement Commandline Parameters
 id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
-version: 2
-date: '2022-01-18'
+version: 3
+date: '2023-02-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
@@ -14,11 +14,10 @@ description: This analytic looks for the presence of suspicious commandline para
   scripts leverage administrative shares and hardcoded parameters that can be used
   as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets
   tools for lateral movement and remote code execution.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*"
-  OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2>&1*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
   | `impacket_lateral_movement_commandline_parameters_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your

detections/endpoint/notepad_with_no_command_line_arguments.yml

@@ -0,0 +1,75 @@
+name: Notepad with no Command Line Arguments
+id: 5adbc5f1-9a2f-41c1-a810-f37e015f8179
+version: 1
+date: '2023-02-22'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies behavior related to default SliverC2 framework where it will inject into Notepad.exe and spawn Notepad.exe with no command line arguments. In testing, this is a common procedure for SliverC2 usage, however may be modified or changed.
+  From Microsoft, "The Sideload, SpawnDll, and Execute-Assembly commands spawn and inject into notepad.exe by default. The following query finds process creation events where the same process creates and injects into notepad.exe within 10 seconds."
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | regex process="(?i)(notepad\.exe.{0,4}$)" 
+  | `notepad_with_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and filtering may need to occur based on organization endpoint behavior.
+references:
+- https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
+- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors#Purple-Team-Section
+tags:
+  analytic_story:
+  - BishopFox Sliver Adversary Emulation Framework
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ with no command line arguments.
+  mitre_attack_id:
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 35
+  security_domain: endpoint

detections/endpoint/suspicious_reg_exe_process.yml

@@ -47,21 +47,28 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Suspicious $Processes.process_path.file_path$ process running with an uncommon
-    parent process $Processes.parent_process_name$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a registry entry.
   mitre_attack_id:
   - T1112
   nist:
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -78,4 +85,4 @@ tags:
   risk_score: 35
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -1,20 +1,18 @@
 name: Suspicious Regsvr32 Register Suspicious Path
 id: 62732736-6250-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-28'
+version: 3
+date: '2023-03-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
-  by using non-standard file extensions to load malciious DLLs. Upon investigating,
+  by using non-standard file extensions to load DLLs. Upon investigating,
   look for network connections to remote destinations (internal or external). Review
   additional parrallel processes and child processes for additional activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` (Processes.process=*appdata*
-  OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll
-  Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
@@ -54,22 +52,29 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Suspicious $Processes.process_path.file_path$ process potentially loading
-    malicious code
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension. 
   mitre_attack_id:
   - T1218
   - T1218.010
   nist:
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -90,4 +95,4 @@ tags:
   risk_score: 35
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/suspicious_rundll32_dllregisterserver.yml

@@ -52,7 +52,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: $Processes.process_path.file_path$ process potentially loading malicious
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL.
     code
   mitre_attack_id:
   - T1218
@@ -61,14 +61,22 @@ tags:
   - PR.PT
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -89,4 +97,4 @@ tags:
   risk_score: 35
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon

detections/endpoint/windows_driver_load_non_standard_path.yml

@@ -1,15 +1,15 @@
 name: Windows Driver Load Non-Standard Path
 id: 9216ef3d-066a-4958-8f27-c84589465e62
-version: 1
-date: '2022-04-04'
+version: 2
+date: '2023-02-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic uses Windows EventCode 7045 to identify new Kernel Mode Drivers being loaded in Windows from a non-standard path.
+description: The following analytic uses Windows XML EventCode 7045 to identify new Kernel Mode Drivers being loaded in Windows from a non-standard path.
   Note that, adversaries may move malicious or vulnerable drivers into these paths and load up. The idea is that this analytic provides visibility into drivers loading in non-standard file paths.
-search: '`wineventlog_system` EventCode=7045 Service_Type="kernel mode driver" NOT (Service_File_Name IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) 
-  | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Service_File_Name Service_Name Service_Start_Type Service_Type 
+search: '`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" NOT (ImagePath IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `windows_driver_load_non_standard_path_filter`'
@@ -34,13 +34,14 @@ tags:
   - Source:Endpoint
   - Stage:Persistence
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/7045_kerneldrivers.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/xml7045_windows-system.log
   impact: 60
   kill_chain_phases:
   - Installation
   message: A kernel mode driver was loaded from a non-standard path on $ComputerName$.
   mitre_attack_id:
   - T1014
+  - T1068
   nist:
   - DE.CM
   observable:
@@ -53,11 +54,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ComputerName
+  - _time
+  - Computer 
   - EventCode 
-  - Service_File_Name
-  - Service_Name
-  - Service_Start_Type
-  - Service_Type 
+  - ImagePath 
+  - ServiceName 
+  - ServiceType 
   risk_score: 36
   security_domain: endpoint

detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml

@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies hardcoded extensions related to the Crypo module within Mimikatz. Moving certificates or downloading them is not malicious, however with Mimikatz having hardcoded names it helps to identify potential usage of certificates being exported.
+description: The following analytic identifies hardcoded extensions related to the Crypto module within Mimikatz. Moving certificates or downloading them is not malicious, however with Mimikatz having hardcoded names it helps to identify potential usage of certificates being exported.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.keyx.rsa.pvk","*sign.rsa.pvk","*sign.dsa.pvk","*dsa.ec.p8k","*dh.ec.p8k", "*.pfx", "*.der") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `windows_mimikatz_crypto_export_file_extensions_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.

detections/endpoint/windows_process_injection_into_notepad.yml

@@ -0,0 +1,74 @@
+name: Windows Process Injection into Notepad
+id: b8340d0f-ba48-4391-bea7-9e793c5aae36
+version: 1
+date: '2023-02-22'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic utilizes Sysmon to identify process injection into Notepad.exe, based on GrantedAccess requests - 0x40 and 0x1fffff. This particular behavior is attributed to the defaults of the SliverC2 framework by BishopFox. 
+  By default, the analytic filters out any SourceImage paths of System32, Syswow64 and program files. Add more as needed, or remove and monitor what is consistently injecting into notepad.exe. 
+  This particular behavior will occur from a source image that is the initial payload dropped. 
+search: '`sysmon` EventCode=10 TargetImage IN (*\\notepad.exe) NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*")) GrantedAccess IN ("0x40","0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by dest SourceImage TargetImage GrantedAccess CallTrace
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_process_injection_into_notepad_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present based on SourceImage paths. If removing the paths is important, realize svchost and many native binaries inject into notepad consistently. Restrict or tune as needed.
+references:
+- https://dominicbreuker.com/post/learning_sliver_c2_08_implant_basics/
+- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
+tags:
+  analytic_story:
+  - BishopFox Sliver Adversary Emulation Framework
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log
+  impact: 40
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $SourceImage$ injecting into $TargetImage$ was identified on endpoint $dest$.
+  mitre_attack_id:
+  - T1055
+  - T1055.002
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: Process
+    role:
+    - Parent Process
+  - name: TargetImage
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest 
+  - SourceImage 
+  - TargetImage 
+  - GrantedAccess 
+  - CallTrace
+  risk_score: 32
+  security_domain: endpoint

detections/endpoint/windows_service_create_sliverc2.yml

@@ -0,0 +1,55 @@
+name: Windows Service Create SliverC2
+id: 89dad3ee-57ec-43dc-9044-131c4edd663f
+version: 1
+date: '2023-03-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: When an adversary utilizes SliverC2 to laterally move with the Psexec module, it will create a service with the name and description of "Sliver" and "Sliver Implant". Note that these may be easily changed and are specific to only SliverC2.
+  We have also created the same regex as Microsoft has outlined to attempt to capture the suspicious service path (regex101 reference).
+search: '`wineventlog_system` EventCode=7045 ServiceName="sliver"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `windows_service_create_sliverc2_filter`'
+how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged from the System Event log. The Windows TA for Splunk is also recommended.
+known_false_positives: False positives should be limited, but if another service out there is named Sliver, filtering may be needed.
+references:
+  - https://github.com/BishopFox/sliver/blob/71f94928bf36c1557ea5fbeffa161b71116f56b2/client/command/exec/psexec.go#LL61C5-L61C16
+  - https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
+  - https://regex101.com/r/DWkkXm/1
+tags:
+  analytic_story:
+  - BishopFox Sliver Adversary Emulation Framework
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log
+  impact: 90
+  kill_chain_phases:
+  - Installation
+  message: A user mode service was created on $ComputerName$ related to SliverC2.
+  mitre_attack_id:
+  - T1569
+  - T1569.002
+  nist:
+  - DE.CM
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - UPDATE
+  risk_score: 90
+  security_domain: endpoint

stories/bishopfox_sliver_adversary_emulation_framework.yml

@@ -0,0 +1,23 @@
+name: BishopFox Sliver Adversary Emulation Framework
+id: 8c2e2cba-3fd8-424f-a890-5080bdaf3f31
+version: 1
+date: '2023-01-24'
+author: Michael Haag, Splunk
+description: The following analytic story providers visibility into the latest adversary TTPs in regard to the use of Sliver. Sliver has gained more traction with adversaries as it is often seen as an alternative to Cobalt Strike. It is designed to be scalable and can be used by organizations of all sizes to perform security testing. Sliver is highly modular and contains an Extension package manager (armory) allowing easy install (automatic compilation) of various 3rd party tools such as BOFs and .NET tooling like Ghostpack (Rubeus, Seatbelt, SharpUp, Certify, and so forth) (CyberReason,2023). 
+narrative: Sliver is an open source cross-platform adversary emulation/red team framework produced by BishopFox.
+references:
+  - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
+  - https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf
+  - https://www.proofpoint.com/uk/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity
+  - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
+  - https://github.com/sliverarmory/armory
+  - https://github.com/BishopFox/sliver
+tags:
+  analytic_story: BishopFox Sliver Adversary Emulation Framework
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/notepad_with_no_command_line_arguments.test.yml

@@ -0,0 +1,13 @@
+name: Notepad with no Command Line Arguments Unit Test
+tests:
+- name: Notepad with no Command Line Arguments
+  file: endpoint/notepad_with_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: notepad_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_driver_load_non_standard_path.test.yml

@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: 7045_kerneldrivers.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/7045_kerneldrivers.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
+  - file_name: xml7045_windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/xml7045_windows-system.log
+    source: XmlWinEventLog:System
+    sourcetype: XmlWinEventLog
     update_timestamp: true

tests/endpoint/windows_process_injection_into_notepad.test.yml

@@ -0,0 +1,13 @@
+name: Windows Process Injection into Notepad Unit Test
+tests:
+- name: Windows Process Injection into Notepad
+  file: endpoint/windows_process_injection_into_notepad.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: T1055_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_service_create_sliverc2.test.yml

@@ -0,0 +1,13 @@
+name: Windows Service Create SliverC2 Unit Test
+tests:
+- name: Windows Service Create SliverC2
+  file: endpoint/windows_service_create_sliverc2.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sliver_windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log
+    source: XmlWinEventLog:System
+    sourcetype: XmlWinEventLog
+    update_timestamp: true