initial 5 new detections and update on existing

detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml

@@ -0,0 +1,66 @@
+name: Remote Process Instantiation via WinRM and Winrs
+id: 0dd296a2-4338-11ec-ba02-3e22fbd008af
+version: 1
+date: '2021-11-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `winrs.exe` with command-line
+  arguments utilized to start a process on a remote endpoint. Red Teams and adversaries
+  alike may abuse the WinRM protocol and this binary for lateral movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=winrs.exe
+  OR Processes.original_file_name=winrs.exe) (Processes.process="*-r:*" OR Processes.process="*-remote:*")
+  by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+ logs with the process name, parent process, and command-line executions from your endpoints.
+known_false_positives: Administrators may leverage WinRM and WinRs to start a process on remote systems, but this
+  activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
+- https://attack.mitre.org/techniques/T1021/006/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - Ransomware
   - Suspicious WMI Use
+  - Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml

@@ -0,0 +1,69 @@
+name: Scheduled Task Creation on Remote Endpoint using At
+id: 4be54858-432f-11ec-8209-3e22fbd008af
+version: 1
+date: '2021-11-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `at.exe` with command-line
+  arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries
+  alike may abuse the Task Scheduler for lateral movement and remote code execution. The `at.exe`
+  binary internally leverages the AT protocol which was deprecated starting with Windows 8 and Windows Server 2012
+  but may still work on previous versions of Windows. Furthermore, attackers may enable this protocol on demand by 
+  changing a sytem registry key.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe
+  OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*)
+  by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+ logs with the process name, parent process, and command-line executions from your endpoints.
+known_false_positives: Administrators may create scheduled tasks on remote systems, but this
+  activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at
+- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053
+  - T1053.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Scheduled Task was created on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  

detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

@@ -0,0 +1,66 @@
+name: Scheduled Task Initiation on Remote Endpoint
+id: 95cf4608-4302-11ec-8194-3e22fbd008af
+version: 1
+date: '2021-11-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `schtasks.exe` with command-line
+  arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and 
+  adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe
+  OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*)
+  by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+ logs with the process name, parent process, and command-line executions from your endpoints.
+known_false_positives: Administrators may start scheduled tasks on remote systems, but this
+  activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
+- https://attack.mitre.org/techniques/T1053/005/
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Scheduled Task was ran on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -1,17 +1,18 @@
 name: Schtasks scheduling job on remote system
 id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6
-version: 4
-date: '2020-07-21'
-author: David Dorsey, Splunk
+version: 5
+date: '2021-11-11'
+author: David Dorsey, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for flags passed to schtasks.exe on the command-line
-  that indicate a job is being scheduled on a remote system.
+description: This analytic looks for the execution of `schtasks.exe` with command-line
+  arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and 
+  adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe
-  Processes.process="*/create*" (Processes.process="* /s *" OR Processes.process="*
-  /S *") by Processes.process_name Processes.process Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = schtasks.exe
+  OR Processes.original_file_name=schtasks.exe) (Processes.process="*/create*" AND Processes.process="*/s*")
+  by Processes.process_name Processes.process Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
@@ -19,7 +20,7 @@ how_to_implement: You must be ingesting data that records process activity from
   ingesting logs with both the process name and command line from your endpoints.
   The command-line arguments are mapped to the "process" field in the Endpoint data
   model.
-known_false_positives: Administrators may create jobs on remote systems, but this
+known_false_positives: Administrators may create scheduled tasks on remote systems, but this
   activity is usually limited to a small set of hosts or users. It is important to
   validate and investigate as appropriate.
 references: []

detections/endpoint/windows_service_creation_on_remote_endpoint.yml

@@ -0,0 +1,67 @@
+name: Windows Service Creation on Remote Endpoint
+id: e0eea4fa-4274-11ec-882b-3e22fbd008af
+version: 1
+date: '2021-11-10'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `sc.exe` with command-line
+  arguments utilized to create a Windows Service on a remote endpoint. Red Teams and 
+  adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
+  OR Processes.original_file_name=“sc.exe”) (Processes.process=*\\\\* AND Processes.process=*create*
+  AND Processes.process=*binpath*) by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+ logs with the process name, parent process, and command-line executions from your endpoints.
+known_false_positives: Administrators may create Windows Services on remote systems, but this
+  activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
+- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service was created on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  

detections/endpoint/windows_service_initiation_on_remote_endpoint.yml

@@ -0,0 +1,66 @@
+name: Windows Service Initiation on Remote Endpoint
+id: 3f519894-4276-11ec-ab02-3e22fbd008af
+version: 1
+date: '2021-11-10'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `sc.exe` with command-line
+  arguments utilized to start a Windows Service on a remote endpoint. Red Teams and 
+  adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
+  OR Processes.original_file_name=“sc.exe”) (Processes.process=*\\\\* AND Processes.process=*start*)
+  by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+ logs with the process name, parent process, and command-line executions from your endpoints.
+known_false_positives: Administrators may start Windows Services on remote systems, but this
+  activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60 
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service was started on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  

tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WinRM and Winrs Unit Test
+tests:
+- name: Remote Process Instantiation via WinRM and Winrs
+  file: endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml

@@ -0,0 +1,12 @@
+name: Scheduled Task Creation on Remote Endpoint using At Unit Test
+tests:
+- name: Scheduled Task Creation on Remote Endpoint using At
+  file: endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Scheduled Task Initiation on Remote Endpoint Unit Test
+tests:
+- name: Scheduled Task Initiation on Remote Endpoint
+  file: endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Windows Service Creation on Remote Endpoint Unit Test
+tests:
+- name: Windows Service Creation on Remote Endpoint
+  file: endpoint/windows_service_creation_on_remote_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: UPDATE_DATASET_URL
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Windows Service Initiation on Remote Endpoint Unit Test
+tests:
+- name: Windows Service Initiation on Remote Endpoint
+  file: endpoint/windows_service_initiation_on_remote_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: UPDATE_DATASET_URL
+    source: WinEventLog:Security
+    sourcetype: WinEventLog