Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

detections/deprecated/dump_lsass_via_procdump_rename.yml

@@ -3,7 +3,7 @@ id: 21276daa-663d-11eb-ae93-0242ac130002
 version: 1
 date: '2021-02-01'
 author: Michael Haag, Splunk
-type: TTP
+type: Hunting
 datamodel: []
 description: 'Detect a renamed instance of procdump.exe dumping the lsass process.
   This query looks for both -mm and -ma usage. -mm will produce a mini dump file and

detections/endpoint/dump_lsass_via_procdump.yml

@@ -1,7 +1,7 @@
 name: Dump LSASS via procdump
 id: 3742ebfe-64c2-11eb-ae93-0242ac130002
-version: 1
-date: '2021-02-01'
+version: 2
+date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -17,14 +17,11 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   the command line. Review other endpoint data sources for cross process (injection)
   into lsass.exe.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
-  OR Processes.process_name=procdump64.exe (Processes.process=*-ma* OR Processes.process=*-mm*)
-  Processes.process=*lsass* by Processes.user Processes.process_name Processes.process
+  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* OR Processes.process=*-mm*)
+  Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.original_file_name
   Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: None identified.
 references:
 - https://attack.mitre.org/techniques/T1003/001/

detections/endpoint/local_account_discovery_with_net.yml

@@ -1,7 +1,7 @@
 name: Local Account Discovery with Net
 id: 5d0d4830-0133-11ec-bae3-acde48001122
-version: 1
-date: '2021-08-19'
+version: 2
+date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic looks for the execution of `net.exe` or `net1.exe` wi
   arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. 
   Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") 
+  as lastTime from datamodel=Endpoint.Processes where `process_net`
   (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`'

detections/endpoint/local_account_discovery_with_wmic.yml

@@ -1,7 +1,7 @@
 name: Local Account Discovery With Wmic
 id: 4902d7aa-0134-11ec-9d65-acde48001122
-version: 1
-date: '2021-08-19'
+version: 2
+date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic looks for the execution of `wmic.exe` with command-li
   arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. 
   Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) 
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) 
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`'

macros/process_procdump.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_procdump

tests/endpoint/dump_lsass_via_procdump_rename.test.yml

@@ -1,7 +1,7 @@
 name: Dump lsass via procdump rename Unit Test
 tests:
 - name: Dump lsass via procdump rename
-  file: endpoint/dump_lsass_via_procdump_rename.yml
+  file: deprecated/dump_lsass_via_procdump_rename.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'