From 15150886c9925a88638113b8524841631bd6c578 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 24 Feb 2023 12:24:55 -0700
Subject: [PATCH 01/10] fixes

---
 ...ateral_movement_commandline_parameters.yml | 13 ++--
 ...notepad_with_no_command_line_arguments.yml | 73 ++++++++++++++++++
 ...mimikatz_crypto_export_file_extensions.yml |  2 +-
 ...windows_process_injection_into_notepad.yml | 75 +++++++++++++++++++
 ...x_sliver_adversary_emulation_framework.yml | 23 ++++++
 ...ad_with_no_command_line_arguments.test.yml | 13 ++++
 ...ws_process_injection_into_notepad.test.yml | 13 ++++
 7 files changed, 204 insertions(+), 8 deletions(-)
 create mode 100644 detections/endpoint/notepad_with_no_command_line_arguments.yml
 create mode 100644 detections/endpoint/windows_process_injection_into_notepad.yml
 create mode 100644 stories/bishopfox_sliver_adversary_emulation_framework.yml
 create mode 100644 tests/endpoint/notepad_with_no_command_line_arguments.test.yml
 create mode 100644 tests/endpoint/windows_process_injection_into_notepad.test.yml

diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index dfdb55894e..cbe547f715 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -1,7 +1,7 @@
 name: Impacket Lateral Movement Commandline Parameters
 id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
-version: 2
-date: '2022-01-18'
+version: 3
+date: '2023-02-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
@@ -14,11 +14,10 @@ description: This analytic looks for the presence of suspicious commandline para
   scripts leverage administrative shares and hardcoded parameters that can be used
   as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets
   tools for lateral movement and remote code execution.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*"
-  OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2&gt;&amp;1*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
   | `impacket_lateral_movement_commandline_parameters_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml
new file mode 100644
index 0000000000..0aaa079b83
--- /dev/null
+++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml
@@ -0,0 +1,73 @@
+name: Notepad with no Command Line Arguments
+id: 5adbc5f1-9a2f-41c1-a810-f37e015f8179
+version: 1
+date: '2023-02-22'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies behavior related to default SliverC2 framework where it will inject into Notepad.exe and spawn Notepad.exe with no command line arguments. In testing, this is a common procedure for SliverC2 usage, however may be modified or changed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | regex process="(?i)(notepad\.exe.{0,4}$)" 
+  | `notepad_with_no_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present and filtering may need to occur based on organization endpoint behavior.
+references:
+- REFERENCE
+tags:
+  analytic_story:
+  - BishopFox Sliver Adversary Emulation Framework
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ with no command line arguments.
+  mitre_attack_id:
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 35
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml
index 7ddcaa92a2..dd85b2f0b0 100644
--- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml
+++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies hardcoded extensions related to the Crypo module within Mimikatz. Moving certificates or downloading them is not malicious, however with Mimikatz having hardcoded names it helps to identify potential usage of certificates being exported.
+description: The following analytic identifies hardcoded extensions related to the Crypto module within Mimikatz. Moving certificates or downloading them is not malicious, however with Mimikatz having hardcoded names it helps to identify potential usage of certificates being exported.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.keyx.rsa.pvk","*sign.rsa.pvk","*sign.dsa.pvk","*dsa.ec.p8k","*dh.ec.p8k", "*.pfx", "*.der") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `windows_mimikatz_crypto_export_file_extensions_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/endpoint/windows_process_injection_into_notepad.yml
new file mode 100644
index 0000000000..e53c0c99a2
--- /dev/null
+++ b/detections/endpoint/windows_process_injection_into_notepad.yml
@@ -0,0 +1,75 @@
+name: Windows Process Injection into Notepad
+id: b8340d0f-ba48-4391-bea7-9e793c5aae36
+version: 1
+date: '2023-02-22'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic utilizes Sysmon to identify process injection into Notepad.exe, based on GrantedAccess requests - 0x40 and 0x1fffff. This particular behavior is attributed to the defaults of the SliverC2 framework by BishopFox. 
+  By default, the analytic filters out any SourceImage paths of System32, Syswow64 and program files. Add more as needed, or remove and monitor what is consistently injecting into notepad.exe. 
+  This particular behavior will occur from a source image that is the initial payload dropped. 
+search: '`sysmon` EventCode=10 TargetImage IN (*\\notepad.exe) NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*")) GrantedAccess IN ("0x40","0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by dest SourceImage TargetImage GrantedAccess CallTrace
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_process_injection_into_notepad_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present based on SourceImage paths. If removing the paths is important, realize svchost and many native binaries inject into notepad consistently. Restrict or tune as needed.
+references:
+- https://dominicbreuker.com/post/learning_sliver_c2_08_implant_basics/
+- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
+tags:
+  analytic_story:
+  - BishopFox Sliver Adversary Emulation Framework
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log
+  impact: 40
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $SourceImage$ injecting into $TargetImage$ was identified on endpoint $dest$.
+  mitre_attack_id:
+  - T1055
+  - T1055.002
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: Process
+    role:
+    - Parent Process
+  - name: TargetImage
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest 
+  - SourceImage 
+  - TargetImage 
+  - GrantedAccess 
+  - CallTrace
+  risk_score: 32
+  security_domain: endpoint
\ No newline at end of file
diff --git a/stories/bishopfox_sliver_adversary_emulation_framework.yml b/stories/bishopfox_sliver_adversary_emulation_framework.yml
new file mode 100644
index 0000000000..a8531255aa
--- /dev/null
+++ b/stories/bishopfox_sliver_adversary_emulation_framework.yml
@@ -0,0 +1,23 @@
+name: BishopFox Sliver Adversary Emulation Framework
+id: 8c2e2cba-3fd8-424f-a890-5080bdaf3f31
+version: 1
+date: '2023-01-24'
+author: Michael Haag, Splunk
+description: The following analytic story providers visibility into the latest adversary TTPs in regard to the use of Sliver. Sliver has gained more traction with adversaries as it is often seen as an alternative to Cobalt Strike. It is designed to be scalable and can be used by organizations of all sizes to perform security testing. Sliver is highly modular and contains an Extension package manager (armory) allowing easy install (automatic compilation) of various 3rd party tools such as BOFs and .NET tooling like Ghostpack (Rubeus, Seatbelt, SharpUp, Certify, and so forth) (CyberReason,2023). 
+narrative: Sliver is an open source cross-platform adversary emulation/red team framework produced by BishopFox.
+references:
+  - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
+  - https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf
+  - https://www.proofpoint.com/uk/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity
+  - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
+  - https://github.com/sliverarmory/armory
+  - https://github.com/BishopFox/sliver
+tags:
+  analytic_story: BishopFox Sliver Adversary Emulation Framework
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
diff --git a/tests/endpoint/notepad_with_no_command_line_arguments.test.yml b/tests/endpoint/notepad_with_no_command_line_arguments.test.yml
new file mode 100644
index 0000000000..95a87b12b0
--- /dev/null
+++ b/tests/endpoint/notepad_with_no_command_line_arguments.test.yml
@@ -0,0 +1,13 @@
+name: Notepad with no Command Line Arguments Unit Test
+tests:
+- name: Notepad with no Command Line Arguments
+  file: endpoint/notepad_with_no_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: notepad_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_process_injection_into_notepad.test.yml b/tests/endpoint/windows_process_injection_into_notepad.test.yml
new file mode 100644
index 0000000000..acba7a6722
--- /dev/null
+++ b/tests/endpoint/windows_process_injection_into_notepad.test.yml
@@ -0,0 +1,13 @@
+name: Windows Process Injection into Notepad Unit Test
+tests:
+- name: Windows Process Injection into Notepad
+  file: endpoint/windows_process_injection_into_notepad.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: T1055_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 631c9d4cf05b0a6d7939217361b3b99a8b40204f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 1 Mar 2023 09:16:22 -0700
Subject: [PATCH 02/10] XML driver load

Updated to XML logs
---
 .../windows_driver_load_non_standard_path.yml       | 13 +++++++------
 .../windows_driver_load_non_standard_path.test.yml  |  8 ++++----
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml
index 066c0483a5..4f7c25018b 100644
--- a/detections/endpoint/windows_driver_load_non_standard_path.yml
+++ b/detections/endpoint/windows_driver_load_non_standard_path.yml
@@ -1,15 +1,15 @@
 name: Windows Driver Load Non-Standard Path
 id: 9216ef3d-066a-4958-8f27-c84589465e62
-version: 1
-date: '2022-04-04'
+version: 2
+date: '2023-02-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic uses Windows EventCode 7045 to identify new Kernel Mode Drivers being loaded in Windows from a non-standard path.
+description: The following analytic uses Windows XML EventCode 7045 to identify new Kernel Mode Drivers being loaded in Windows from a non-standard path.
   Note that, adversaries may move malicious or vulnerable drivers into these paths and load up. The idea is that this analytic provides visibility into drivers loading in non-standard file paths.
-search: '`wineventlog_system` EventCode=7045 Service_Type="kernel mode driver" NOT (Service_File_Name IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) 
-  | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Service_File_Name Service_Name Service_Start_Type Service_Type 
+search: '`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" NOT (ImagePath IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `windows_driver_load_non_standard_path_filter`'
@@ -34,13 +34,14 @@ tags:
   - Source:Endpoint
   - Stage:Persistence
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/7045_kerneldrivers.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/xml7045_windows-system.log
   impact: 60
   kill_chain_phases:
   - Installation
   message: A kernel mode driver was loaded from a non-standard path on $ComputerName$.
   mitre_attack_id:
   - T1014
+  - T1068
   nist:
   - DE.CM
   observable:
diff --git a/tests/endpoint/windows_driver_load_non_standard_path.test.yml b/tests/endpoint/windows_driver_load_non_standard_path.test.yml
index cc7095689b..4fec7cc049 100644
--- a/tests/endpoint/windows_driver_load_non_standard_path.test.yml
+++ b/tests/endpoint/windows_driver_load_non_standard_path.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: 7045_kerneldrivers.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/7045_kerneldrivers.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
+  - file_name: xml7045_windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/xml7045_windows-system.log
+    source: XmlWinEventLog:System
+    sourcetype: XmlWinEventLog
     update_timestamp: true
\ No newline at end of file

From cef780f011e412bd5bae35dd3d17d87b173bfd73 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 2 Mar 2023 07:08:40 -0700
Subject: [PATCH 03/10] Update suspicious_regsvr32_register_suspicious_path.yml

---
 ...ious_regsvr32_register_suspicious_path.yml | 59 ++++++++++++++-----
 1 file changed, 45 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 7c32281b0d..1da6809953 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -1,20 +1,18 @@
 name: Suspicious Regsvr32 Register Suspicious Path
 id: 62732736-6250-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-28'
+version: 3
+date: '2023-03-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
-  by using non-standard file extensions to load malciious DLLs. Upon investigating,
+  by using non-standard file extensions to load DLLs. Upon investigating,
   look for network connections to remote destinations (internal or external). Review
   additional parrallel processes and child processes for additional activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` (Processes.process=*appdata*
-  OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll
-  Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
@@ -54,22 +52,29 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Suspicious $Processes.process_path.file_path$ process potentially loading
-    malicious code
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension. 
   mitre_attack_id:
   - T1218
   - T1218.010
   nist:
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -91,3 +96,29 @@ tags:
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of parent_process_name$ spawning process_name$ was identified on endpoint Computer$ by user user$ attempting to decode a file.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file

From 1099e16cf88d6dd827903f68f03da7946b2c6b19 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 2 Mar 2023 07:13:02 -0700
Subject: [PATCH 04/10] Update suspicious_regsvr32_register_suspicious_path.yml

---
 ...ious_regsvr32_register_suspicious_path.yml | 28 +------------------
 1 file changed, 1 insertion(+), 27 deletions(-)

diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 1da6809953..9468a3bdb9 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -95,30 +95,4 @@ tags:
   risk_score: 35
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
-
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of parent_process_name$ spawning process_name$ was identified on endpoint Computer$ by user user$ attempting to decode a file.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Parent Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
\ No newline at end of file
+  - Splunk_TA_microsoft_sysmon
\ No newline at end of file

From 38fc323b98bd7bb57f5e4d31d3fdcb6d8e03b151 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 2 Mar 2023 08:19:01 -0700
Subject: [PATCH 05/10] Update suspicious_rundll32_dllregisterserver.yml

---
 .../suspicious_rundll32_dllregisterserver.yml | 22 +++++++++++++------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index c8be5358d0..ceace0ff05 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -52,7 +52,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: $Processes.process_path.file_path$ process potentially loading malicious
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL.
     code
   mitre_attack_id:
   - T1218
@@ -61,14 +61,22 @@ tags:
   - PR.PT
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -89,4 +97,4 @@ tags:
   risk_score: 35
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon
\ No newline at end of file

From cdd7de9ad483d425f131ac93f847483aeb0a204a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 2 Mar 2023 08:21:07 -0700
Subject: [PATCH 06/10] Update suspicious_rundll32_dllregisterserver.yml

---
 detections/endpoint/suspicious_rundll32_dllregisterserver.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index ceace0ff05..38bc57429d 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -70,7 +70,7 @@ tags:
     role:
     - Victim
   - name: parent_process_name
-    type: Parent Process
+    type: Process
     role:
     - Parent Process
   - name: process_name

From c08564d2d714883cad0247a895cc4ff3f332aeae Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 2 Mar 2023 08:24:32 -0700
Subject: [PATCH 07/10] Update suspicious_reg_exe_process.yml

---
 .../endpoint/suspicious_reg_exe_process.yml   | 23 ++++++++++++-------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index aea9e3c110..1e9826eb13 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -47,21 +47,28 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Suspicious $Processes.process_path.file_path$ process running with an uncommon
-    parent process $Processes.parent_process_name$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a registry entry.
   mitre_attack_id:
   - T1112
   nist:
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -78,4 +85,4 @@ tags:
   risk_score: 35
   security_domain: endpoint
   supported_tas:
-  - Splunk_TA_microsoft_sysmon
+  - Splunk_TA_microsoft_sysmon
\ No newline at end of file

From f239a658b38296c8c5edfd1f16790705e623e52a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Mar 2023 05:59:36 -0700
Subject: [PATCH 08/10] Sliver

---
 ...notepad_with_no_command_line_arguments.yml |  4 +-
 .../windows_driver_load_non_standard_path.yml | 10 ++--
 .../windows_service_create_sliverc2.yml       | 56 +++++++++++++++++++
 .../windows_service_create_sliverc2.test.yml  | 13 +++++
 4 files changed, 77 insertions(+), 6 deletions(-)
 create mode 100644 detections/endpoint/windows_service_create_sliverc2.yml
 create mode 100644 tests/endpoint/windows_service_create_sliverc2.test.yml

diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml
index 0aaa079b83..fff9217112 100644
--- a/detections/endpoint/notepad_with_no_command_line_arguments.yml
+++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml
@@ -7,6 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic identifies behavior related to default SliverC2 framework where it will inject into Notepad.exe and spawn Notepad.exe with no command line arguments. In testing, this is a common procedure for SliverC2 usage, however may be modified or changed.
+  From Microsoft, "The Sideload, SpawnDll, and Execute-Assembly commands spawn and inject into notepad.exe by default. The following query finds process creation events where the same process creates and injects into notepad.exe within 10 seconds."
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
@@ -16,7 +17,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present and filtering may need to occur based on organization endpoint behavior.
 references:
-- REFERENCE
+- https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
+- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors#Purple-Team-Section
 tags:
   analytic_story:
   - BishopFox Sliver Adversary Emulation Framework
diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml
index 4f7c25018b..7d8bdb9b97 100644
--- a/detections/endpoint/windows_driver_load_non_standard_path.yml
+++ b/detections/endpoint/windows_driver_load_non_standard_path.yml
@@ -54,11 +54,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ComputerName
+  - _time
+  - Computer 
   - EventCode 
-  - Service_File_Name
-  - Service_Name
-  - Service_Start_Type
-  - Service_Type 
+  - ImagePath 
+  - ServiceName 
+  - ServiceType 
   risk_score: 36
   security_domain: endpoint
diff --git a/detections/endpoint/windows_service_create_sliverc2.yml b/detections/endpoint/windows_service_create_sliverc2.yml
new file mode 100644
index 0000000000..14471645ee
--- /dev/null
+++ b/detections/endpoint/windows_service_create_sliverc2.yml
@@ -0,0 +1,56 @@
+name: Windows Service Create SliverC2
+id: 89dad3ee-57ec-43dc-9044-131c4edd663f
+version: 1
+date: '2023-03-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: When an adversary utilizes SliverC2 to laterally move with the Psexec module, it will create a service with the name and description of "Sliver" and "Sliver Implant". Note that these may be easily changed and are specific to only SliverC2.
+  We have also created the same regex as Microsoft has outlined to attempt to capture the suspicious service path (regex101 reference).
+search: '`wineventlog_system` EventCode=7045 ServiceName="sliver"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `windows_service_create_sliverc2_filter`'
+how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged from the System Event log. The Windows TA for Splunk is also recommended.
+known_false_positives: False positives should be limited, but if another service out there is named Sliver, filtering may be needed.
+references:
+  - https://github.com/BishopFox/sliver/blob/71f94928bf36c1557ea5fbeffa161b71116f56b2/client/command/exec/psexec.go#LL61C5-L61C16
+  - https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
+  - https://regex101.com/r/DWkkXm/1
+tags:
+  analytic_story:
+  - BishopFox Sliver Adversary Emulation Framework
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log
+  impact: 90
+  kill_chain_phases:
+  - Installation
+  message: A user mode service was created on $ComputerName$ related to SliverC2.
+  mitre_attack_id:
+  - T1569
+  - T1569.002
+  nist:
+  - DE.CM
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - UPDATE
+  risk_score: 90
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_service_create_sliverc2.test.yml b/tests/endpoint/windows_service_create_sliverc2.test.yml
new file mode 100644
index 0000000000..7b7df9cdeb
--- /dev/null
+++ b/tests/endpoint/windows_service_create_sliverc2.test.yml
@@ -0,0 +1,13 @@
+name: Windows Service Create SliverC2 Unit Test
+tests:
+- name: Windows Service Create SliverC2
+  file: endpoint/windows_service_create_sliverc2.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sliver_windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: true

From cea7d34435767c36fdfcb37004617ef96bbfdccd Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 3 Mar 2023 14:38:03 -0700
Subject: [PATCH 09/10] not datamodel

---
 detections/endpoint/windows_process_injection_into_notepad.yml | 3 +--
 detections/endpoint/windows_service_create_sliverc2.yml        | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/endpoint/windows_process_injection_into_notepad.yml
index e53c0c99a2..88e8c3f10e 100644
--- a/detections/endpoint/windows_process_injection_into_notepad.yml
+++ b/detections/endpoint/windows_process_injection_into_notepad.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2023-02-22'
 author: Michael Haag, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes Sysmon to identify process injection into Notepad.exe, based on GrantedAccess requests - 0x40 and 0x1fffff. This particular behavior is attributed to the defaults of the SliverC2 framework by BishopFox. 
   By default, the analytic filters out any SourceImage paths of System32, Syswow64 and program files. Add more as needed, or remove and monitor what is consistently injecting into notepad.exe. 
   This particular behavior will occur from a source image that is the initial payload dropped. 
diff --git a/detections/endpoint/windows_service_create_sliverc2.yml b/detections/endpoint/windows_service_create_sliverc2.yml
index 14471645ee..eaf0689cea 100644
--- a/detections/endpoint/windows_service_create_sliverc2.yml
+++ b/detections/endpoint/windows_service_create_sliverc2.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2023-03-03'
 author: Michael Haag, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: When an adversary utilizes SliverC2 to laterally move with the Psexec module, it will create a service with the name and description of "Sliver" and "Sliver Implant". Note that these may be easily changed and are specific to only SliverC2.
   We have also created the same regex as Microsoft has outlined to attempt to capture the suspicious service path (regex101 reference).
 search: '`wineventlog_system` EventCode=7045 ServiceName="sliver"

From 5728a3f9d0def4108c4200895157a53aa067546e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 6 Mar 2023 04:55:36 -0700
Subject: [PATCH 10/10] Update windows_service_create_sliverc2.test.yml

---
 tests/endpoint/windows_service_create_sliverc2.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_service_create_sliverc2.test.yml b/tests/endpoint/windows_service_create_sliverc2.test.yml
index 7b7df9cdeb..fae6b890ec 100644
--- a/tests/endpoint/windows_service_create_sliverc2.test.yml
+++ b/tests/endpoint/windows_service_create_sliverc2.test.yml
@@ -8,6 +8,6 @@ tests:
   attack_data:
   - file_name: sliver_windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log
-    source: WinEventLog:System
-    sourcetype: WinEventLog
+    source: XmlWinEventLog:System
+    sourcetype: XmlWinEventLog
     update_timestamp: true