Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2021-08-19 11:07:32 +00:00
parent 611ef2af16 63d21f2e46
commit 484df79def
215 changed files with 24366 additions and 5190 deletions
@@ -1,21 +1,22 @@
-author: Rod Soto, Splunk
-datamodel: []
+name: Amazon EKS Kubernetes activity by src ip
+id: a636cca4-7434-4a15-a278-c70734938e39
+version: 1
 date: '2020-04-13'
+author: Rod Soto, Splunk
+type: Investigation
+datamodel: []
 description: This search provides investigation data about requests via user agent,
  authentication request URI, verb and cluster name data against Kubernetes cluster
  from a specific IP address
+search: '`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$
+  | stats count min(_time) as firstTime max(_time) as lastTime values(user.username)
+  values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision
+  src_ip'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch
  EKS inputs.
-id: a636cca4-7434-4a15-a278-c70734938e39
-inputs:
- src_ip
 known_false_positives: ''
-name: Amazon EKS Kubernetes activity by src ip
-search: '`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search
-  src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username)
-  values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision
-  src_ip'
+references: []
 tags:
  analytic_story:
  - Kubernetes Scanning Activity
@@ -31,5 +32,3 @@ tags:
  - userAgent
  - annotations.authorization.k8s.io/decision
  security_domain: network
-type: Investigation
-version: 1
@@ -5,16 +5,17 @@ date: '2021-08-17'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel: []
-description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
-  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
-  | spath path=responseElements.imageScanFindings.findings{} output=findings 
-  | mvexpand findings | spath input=findings| search severity=HIGH
-  | rename name as finding_name, description as finding_description, 
-  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
-  | eval finding = finding_name.", ".finding_description
-  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+description: This search looks for AWS CloudTrail events from AWS Elastic Container
+  Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
+  with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
+  | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
+  findings | spath input=findings| search severity=HIGH | rename name as finding_name,
+  description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
+  requestParameters.repositoryName as repositoryName | eval finding = finding_name.",
+  ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by
+  awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName,
+  src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `aws_ecr_container_scanning_findings_high_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
@@ -5,16 +5,17 @@ date: '2021-08-17'
 author: Patrick Bareiss, Splunk
 type: Hunting
 datamodel: []
-description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
-  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
-  | spath path=responseElements.imageScanFindings.findings{} output=findings 
-  | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
-  | rename name as finding_name, description as finding_description, 
-  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
-  | eval finding = finding_name.", ".finding_description
-  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+description: This search looks for AWS CloudTrail events from AWS Elastic Container
+  Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
+  with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
+  | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
+  findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
+  | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest
+  as imageDigest, requestParameters.repositoryName as repositoryName | eval finding
+  = finding_name.", ".finding_description | stats min(_time) as firstTime max(_time)
+  as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user,
+  userName, src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
@@ -5,16 +5,17 @@ date: '2021-08-17'
 author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel: []
-description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR).
-  You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
-search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings 
-  | spath path=responseElements.imageScanFindings.findings{} output=findings 
-  | mvexpand findings | spath input=findings| search severity=MEDIUM
-  | rename name as finding_name, description as finding_description, 
-  requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName
-  | eval finding = finding_name.", ".finding_description
-  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+description: This search looks for AWS CloudTrail events from AWS Elastic Container
+  Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
+  with the results.
+search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
+  | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
+  findings | spath input=findings| search severity=MEDIUM | rename name as finding_name,
+  description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
+  requestParameters.repositoryName as repositoryName | eval finding = finding_name.",
+  ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by
+  awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName,
+  src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `aws_ecr_container_scanning_findings_medium_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
@@ -1,21 +1,22 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: AWS Investigate Security Hub alerts by dest
+id: b0d2e6a8-75fa-4b1b-9486-3d32acadf822
+version: 1
 date: '2020-06-08'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search retrieves the all the alerts created by AWS Security Hub
  for a specific dest(instance_id).
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
-  inputs.
-id: b0d2e6a8-75fa-4b1b-9486-3d32acadf822
-inputs:
- dest
-known_false_positives: ''
-name: AWS Investigate Security Hub alerts by dest
-search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance
-  | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance
+search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance |
+  rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance
  as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text
  as Remediation |  table dest Title ProductArn Description FirstObservedAt RecordState
  Remediation'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
+  inputs.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Cloud Compute Instance
@@ -37,5 +38,3 @@ tags:
  - FirstObservedAt
  - RecordState
  security_domain: network
-type: Investigation
-version: 1
@@ -1,20 +1,20 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: AWS Investigate User Activities By AccessKeyId
+id: 703b65a4-a0ae-4171-965d-45507506c64f
+version: 1
 date: '2018-06-08'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search retrieves the times, ARN, source IPs, AWS regions, event
  names, and the result of the event for specific credentials.
+search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$
+  | spath output=user path=userIdentity.arn  | rename sourceIPAddress as src_ip |
+  table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: 703b65a4-a0ae-4171-965d-45507506c64f
-inputs:
- accessKeyId
 known_false_positives: ''
-name: AWS Investigate User Activities By AccessKeyId
-search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId|
-  search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn  | rename
-  sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode,
-  errorMessage'
+references: []
 tags:
  analytic_story:
  - AWS Cross Account Activity
@@ -32,5 +32,3 @@ tags:
  - errorCode
  - errorMessage
  security_domain: network
-type: Investigation
-version: 1
@@ -1,20 +1,21 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: AWS Investigate User Activities By ARN
+id: bc91a8cd-35e7-4bb2-6140-e756cc46fd72
+version: 2
 date: '2019-04-30'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search lists all the logged CloudTrail activities by a specific
  user ARN and will create a table containing the source of the user, the region of
  the activity, the name and type of the event, the action taken, and all the user's
  identity information.
+search: '`cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName
+  userIdentity.arn aws_account_id src awsRegion eventName eventType'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: bc91a8cd-35e7-4bb2-6140-e756cc46fd72
-inputs:
- user
 known_false_positives: ''
-name: AWS Investigate User Activities By ARN
-search: '`cloudtrail` | search user=$user$| table _time userIdentity.type
-  userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType'
+references: []
 tags:
  analytic_story:
  - AWS Cryptomining
@@ -45,5 +46,3 @@ tags:
  - eventName
  - eventType
  security_domain: network
-type: Investigation
-version: 2
@@ -1,18 +1,19 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: AWS Network ACL Details from ID
+id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
+version: 1
 date: '2017-01-22'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search queries AWS description logs and returns all the information
  about a specific network ACL via network ACL ID
+search: '`aws_description` | rename id as networkAclId | search  networkAclId=$networkAclId$
+  | table id account_id vpc_id network_acl_entries{}.*'
 how_to_implement: In order to implement this search, you must install the AWS App
  for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
  and configure your AWS description inputs.
-id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
-inputs:
- networkAclId
 known_false_positives: ''
-name: AWS Network ACL Details from ID
-search: '`aws_description` | rename id as networkAclId | search  networkAclId=$networkAclId$
-  | table id account_id vpc_id network_acl_entries{}.*'
+references: []
 tags:
  analytic_story:
  - AWS Network ACL Activity
@@ -28,5 +29,3 @@ tags:
  - vpc_id
  - network_acl_entries{}.*
  security_domain: network
-type: Investigation
-version: 1
@@ -1,21 +1,22 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: AWS Network Interface details via resourceId
+id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
+version: 1
 date: '2018-05-07'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search queries AWS configuration logs and returns the information
  about a specific network interface via network interface ID. The information will
  include the ARN of the network interface, its relationships with other AWS resources,
  the public and the private IP associated with the network interface.
+search: '`aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType
+  relationships{}.name relationships{}.resourceId  configuration.privateIpAddresses{}.privateIpAddress
+  configuration.privateIpAddresses{}.association.publicIp'
 how_to_implement: In order to implement this search, you must install the AWS App
  for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
  and configure your AWS configuration inputs
-id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
-inputs:
- resourceId
 known_false_positives: ''
-name: AWS Network Interface details via resourceId
-search: '`aws_config` resourceId=$resourceId$ | table _time ARN
-  relationships{}.resourceType relationships{}.name relationships{}.resourceId  configuration.privateIpAddresses{}.privateIpAddress
-  configuration.privateIpAddresses{}.association.publicIp'
+references: []
 tags:
  analytic_story:
  - AWS Network ACL Activity
@@ -34,5 +35,3 @@ tags:
  - configuration.privateIpAddresses{}.privateIpAddress
  - configuration.privateIpAddresses{}.association.publicIp
  security_domain: network
-type: Investigation
-version: 1
@@ -1,22 +1,22 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: AWS S3 Bucket details via bucketName
+id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242
+version: 1
 date: '2018-06-26'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search queries AWS configuration logs and returns the information
  about a specific S3 bucket. The information returned includes the time the S3 bucket
  was created, the resource ID, the region it belongs to, the value of action performed,
  AWS account ID, and configuration values of the access-control lists associated
  with the bucket.
+search: '`aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$
+  | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList'
 how_to_implement: To implement this search, you must install the AWS App for Splunk
  (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and
  configure your AWS inputs.
-id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242
-inputs:
- bucketName
 known_false_positives: ''
-name: AWS S3 Bucket details via bucketName
-search: '`aws_config` | rename resourceId as bucketName |search
-  bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action
-  aws_account_id supplementaryConfiguration.AccessControlList'
+references: []
 tags:
  analytic_story:
  - Suspicious AWS S3 Activities
@@ -33,5 +33,3 @@ tags:
  - aws_account_id
  - supplementaryConfiguration.AccessControlList
  security_domain: network
-type: Investigation
-version: 1
@@ -22,10 +22,10 @@ references: []
 tags:
  analytic_story:
  - AWS User Monitoring
-  detections:
-  - Detect Spike in AWS API Activity
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect Spike in AWS API Activity
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -28,10 +28,10 @@ tags:
  - AWS Network ACL Activity
  - Command and Control
  - Suspicious AWS Traffic
-  detections:
-  - Detect Spike in blocked Outbound Traffic from your AWS
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect Spike in blocked Outbound Traffic from your AWS
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -41,4 +41,4 @@ tags:
  - action
  - src_ip
  - dest_ip
-  security_domain: network
+  security_domain: network
@@ -47,4 +47,4 @@ tags:
  - _time
  - All_Changes.user
  - All_Changes.status
-  security_domain: network
+  security_domain: network
@@ -51,4 +51,4 @@ tags:
  - All_Changes.action
  - All_Changes.status
  - All_Changes.object_category
-  security_domain: network
+  security_domain: network
@@ -51,4 +51,4 @@ tags:
  - All_Changes.action
  - All_Changes.status
  - All_Changes.object_category
-  security_domain: network
+  security_domain: network
@@ -47,4 +47,4 @@ tags:
  - All_Changes.user
  - All_Changes.status
  - All_Changes.object_category
-  security_domain: network
+  security_domain: network
@@ -33,10 +33,10 @@ tags:
  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
-  detections:
-  - Abnormally High AWS Instances Launched by User - MLTK
  deployments:
  - Daily Cache Updates
+  detections:
+  - Abnormally High AWS Instances Launched by User - MLTK
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -46,4 +46,4 @@ tags:
  - eventName
  - errorCode
  - src_user
-  security_domain: network
+  security_domain: network
@@ -33,10 +33,10 @@ references: []
 tags:
  analytic_story:
  - Suspicious AWS EC2 Activities
-  detections:
-  - Abnormally High AWS Instances Terminated by User - MLTK
  deployments:
  - Daily Cache Updates
+  detections:
+  - Abnormally High AWS Instances Terminated by User - MLTK
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -46,4 +46,4 @@ tags:
  - eventName
  - errorCode
  - src_user
-  security_domain: network
+  security_domain: network
@@ -23,10 +23,10 @@ references: []
 tags:
  analytic_story:
  - AWS Network ACL Activity
-  detections:
-  - Detect Spike in Network ACL Activity
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect Spike in Network ACL Activity
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -34,4 +34,4 @@ tags:
  required_fields:
  - _time
  - userIdentity.arn
-  security_domain: network
+  security_domain: network
@@ -22,10 +22,10 @@ references: []
 tags:
  analytic_story:
  - Suspicious AWS S3 Activities
-  detections:
-  - Detect Spike in S3 Bucket deletion
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect Spike in S3 Bucket deletion
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -33,4 +33,4 @@ tags:
  required_fields:
  - _time
  - userIdentity.arn
-  security_domain: network
+  security_domain: network
@@ -23,10 +23,10 @@ references: []
 tags:
  analytic_story:
  - AWS User Monitoring
-  detections:
-  - Detect Spike in Security Group Activity
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect Spike in Security Group Activity
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -34,4 +34,4 @@ tags:
  required_fields:
  - _time
  - userIdentity.arn
-  security_domain: network
+  security_domain: network
@@ -21,10 +21,10 @@ references: []
 tags:
  analytic_story:
  - AWS User Monitoring
-  detections:
-  - Detect AWS API Activities From Unapproved Accounts
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect AWS API Activities From Unapproved Accounts
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -33,4 +33,4 @@ tags:
  - _time
  - errorCode
  - userName
-  security_domain: network
+  security_domain: network
@@ -1,18 +1,13 @@
-author: Rod Soto, Splunk
-datamodel: []
+name: GCP Kubernetes activity by src ip
+id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f
+version: 1
 date: '2020-04-13'
+author: Rod Soto, Splunk
+type: Investigation
+datamodel: []
 description: This search provides investigation data about requests via user agent,
  authentication request URI, resource path and cluster name data against Kubernetes
  cluster from a specific IP address
-how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later),
-  then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
-  You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection
-  to filter out FPs.
-id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f
-inputs:
- src_ip
-known_false_positives: ''
-name: GCP Kubernetes activity by src ip
 search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp
  as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time)
  as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName)
@@ -20,6 +15,12 @@ search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.
  as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as
  user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name
  data.resource.type'
+how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later),
+  then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
+  You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection
+  to filter out FPs.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Kubernetes Scanning Activity
@@ -36,5 +37,3 @@ tags:
  - data.resource.labels.cluster_name
  - data.resource.type
  security_domain: network
-type: Investigation
-version: 1
@@ -1,23 +1,23 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: Get All AWS Activity From City
+id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8
+version: 1
 date: '2018-03-19'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search retrieves all the activity from a specific city and will
  create a table containing the time, city, ARN, username, the type of user, the source
  IP address, the AWS region the activity was in, the API called, and whether or not
  the API call was successful.
+search: '`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user
+  path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath
+  output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table
+  _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8
-inputs:
- City
 known_false_positives: ''
-name: Get All AWS Activity From City
-search: '`cloudtrail` | iplocation sourceIPAddress | search
-  City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName
-  path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
-  sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip,
-  awsRegion, eventName, errorCode'
+references: []
 tags:
  analytic_story:
  - AWS Suspicious Provisioning Activities
@@ -34,5 +34,3 @@ tags:
  - eventName
  - errorCode
  security_domain: network
-type: Investigation
-version: 1
@@ -1,23 +1,24 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: Get All AWS Activity From Country
+id: e763cdb9-00da-41e0-9bda-444debc9501a
+version: 1
 date: '2018-03-19'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search retrieves all the activity from a specific country and will
  create a table containing the time, country, ARN, username, the type of user, the
  source IP address, the AWS region the activity was in, the API called, and whether
  or not the API call was successful.
+search: '`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath
+  output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName
+  | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip
+  | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName,
+  errorCode'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: e763cdb9-00da-41e0-9bda-444debc9501a
-inputs:
- Country
 known_false_positives: ''
-name: Get All AWS Activity From Country
-search: '`cloudtrail` | iplocation sourceIPAddress | search
-  Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName
-  path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
-  sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip,
-  awsRegion, eventName, errorCode'
+references: []
 tags:
  analytic_story:
  - AWS Suspicious Provisioning Activities
@@ -34,5 +35,3 @@ tags:
  - eventName
  - errorCode
  security_domain: network
-type: Investigation
-version: 1
@@ -1,23 +1,23 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: Get All AWS Activity From IP Address
+id: 446ec87a-85c6-40d4-b060-bea4498281d6
+version: 1
 date: '2018-03-19'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search retrieves all the activity from a specific IP address and
  will create a table containing the time, ARN, username, the type of user, the IP
  address, the AWS region the activity was in, the API called, and whether or not
  the API call was successful.
+search: '`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath
+  output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName
+  | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip
+  | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: 446ec87a-85c6-40d4-b060-bea4498281d6
-inputs:
- src_ip
 known_false_positives: ''
-name: Get All AWS Activity From IP Address
-search: '`cloudtrail` | iplocation sourceIPAddress | search
-  src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName
-  path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
-  sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion,
-  eventName, errorCode'
+references: []
 tags:
  analytic_story:
  - AWS Network ACL Activity
@@ -39,5 +39,3 @@ tags:
  - eventName
  - errorCode
  security_domain: network
-type: Investigation
-version: 1
@@ -1,23 +1,23 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: Get All AWS Activity From Region
+id: 5b794bef-1743-4f6f-804a-43915a2702ff
+version: 1
 date: '2018-03-19'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search retrieves all the activity from a specific geographic region
  and will create a table containing the time, geographic region, ARN, username, the
  type of user, the source IP address, the AWS region the activity was in, the API
  called, and whether or not the API call was successful.
+search: '`cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath
+  output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName
+  | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip
+  | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: 5b794bef-1743-4f6f-804a-43915a2702ff
-inputs:
- Region
 known_false_positives: ''
-name: Get All AWS Activity From Region
-search: '`cloudtrail` | iplocation sourceIPAddress | search
-  Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName
-  path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
-  sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip,
-  awsRegion, eventName, errorCode'
+references: []
 tags:
  analytic_story:
  - AWS Suspicious Provisioning Activities
@@ -34,5 +34,3 @@ tags:
  - eventName
  - errorCode
  security_domain: network
-type: Investigation
-version: 1
@@ -1,25 +1,25 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: Get EC2 Instance Details by instanceId
+id: f3db4d1b-5f33-4b01-c541-c7ah9514c242
+version: 1
 date: '2018-02-12'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search queries AWS description logs and returns all the information
  about a specific instance via the instanceId field
+search: '`aws_description` | dedup id sortby -_time |rename id as instanceId|  search
+  instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value,"
+  = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table
+  id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time,
+  state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID,
+  instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time
+  as "Launch Time", placement as "Availability Zone", state as State, subnet_id as
+  Subnet, "tags.Name" as Name, vpc_id as VPC'
 how_to_implement: In order to implement this search, you must install the AWS App
  for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
  and configure your AWS description inputs.
-id: f3db4d1b-5f33-4b01-c541-c7ah9514c242
-inputs:
- instanceId
 known_false_positives: ''
-name: Get EC2 Instance Details by instanceId
-search: '`aws_description` | dedup id
-  sortby -_time |rename id as instanceId|  search instanceId=$instanceId$ | spath
-  output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address
-  == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id,
-  placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id,
-  tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address
-  as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement
-  as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name,
-  vpc_id as VPC'
+references: []
 tags:
  analytic_story:
  - AWS Cryptomining
@@ -44,5 +44,3 @@ tags:
  - vpc_id
  - subnet_id
  security_domain: network
-type: Investigation
-version: 1
@@ -1,20 +1,21 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: Get EC2 Launch Details
+id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
+version: 1
 date: '2018-03-12'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search returns some of the launch details for a EC2 instance.
+search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId
+  as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress,
+  responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
+  as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
+  arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName'
 how_to_implement: In order to implement this search, you must install the AWS App
  for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
  and configure your AWS description inputs.
-id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
-inputs:
- dest
 known_false_positives: ''
-name: Get EC2 Launch Details
-search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as
-  arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress
-  as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
-  as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
-  arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName'
+references: []
 tags:
  analytic_story:
  - AWS Cryptomining
@@ -26,7 +27,7 @@ tags:
  - Splunk Security Analytics for AWS
  required_fields:
  - _time
-  - dest 
+  - dest
  - userIdentity.arn
  - responseElements.instancesSet.items{}.instanceId
  - responseElements.instancesSet.items{}.privateIpAddress
@@ -34,5 +35,3 @@ tags:
  - responseElements.instancesSet.items{}.architecture
  - responseElements.instancesSet.items{}.keyName
  security_domain: network
-type: Investigation
-version: 1
@@ -1,20 +1,20 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: Investigate AWS activities via region name
+id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
+version: 1
 date: '2018-02-09'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search lists all the user activities logged by CloudTrail for a
  specific region in question and will create a table of the values of parameters
  requested, the type of the event and the response from the AWS API by each user
+search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId
+  as instanceId | stats values(eventName) by user instanceId vendor_region'
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
-inputs:
- vendor_region
 known_false_positives: ''
-name: Investigate AWS activities via region name
-search: '`cloudtrail` vendor_region=$vendor_region$| rename
-  requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName)
-  by user instanceId vendor_region'
+references: []
 tags:
  analytic_story:
  - AWS Cryptomining
@@ -31,5 +31,3 @@ tags:
  - eventName
  - user
  security_domain: network
-type: Investigation
-version: 1
@@ -1,20 +1,21 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: Investigate AWS User Activities by user field
+id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
+version: 1
 date: '2018-03-12'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search lists all the logged CloudTrail activities by a specific
  user and will create a table containing the source of the user, the region of the
  activity, the name and type of the event, the action taken, and the user's identity
  information.
+search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName
+  userIdentity.arn aws_account_id src awsRegion eventName eventType '
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
-id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
-inputs:
- user
 known_false_positives: ''
-name: Investigate AWS User Activities by user field
-search: '`cloudtrail` user=$user$ | table _time userIdentity.type
-  userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType '
+references: []
 tags:
  analytic_story:
  - AWS User Monitoring
@@ -34,5 +35,3 @@ tags:
  - eventName
  - eventType
  security_domain: network
-type: Investigation
-version: 1
@@ -1,16 +1,17 @@
-author: Rico Valdez, Splunk
-datamodel: []
-date: '2020-04-02'
-description: This search returns all okta events associated with a specific app
-how_to_implement: You must be ingesting Okta logs
-id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
-inputs:
- app
-known_false_positives: ''
 name: Investigate Okta Activity by app
-search: '`okta` app=$app$ | rename client.geographicalContext.country as
-  country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
+version: 1
+date: '2020-04-02'
+author: Rico Valdez, Splunk
+type: Investigation
+datamodel: []
+description: This search returns all okta events associated with a specific app
+search: '`okta` app=$app$ | rename client.geographicalContext.country as country,
+  client.geographicalContext.state as state, client.geographicalContext.city as city
+  | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+how_to_implement: You must be ingesting Okta logs
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Suspicious Okta Activity
@@ -28,5 +29,3 @@ tags:
  - result
  - outcome.reason
  security_domain: network
-type: Investigation
-version: 1
@@ -1,16 +1,17 @@
-author: Rico Valdez, Splunk
-datamodel: []
-date: '2020-04-02'
-description: This search returns all okta events from a specific IP address.
-how_to_implement: You must be ingesting Okta logs
-id: 56aae066-d619-477c-93e3-3fb83b2d23c3
-inputs:
- user
-known_false_positives: ''
 name: Investigate Okta Activity by IP Address
-search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country
-  as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+id: 56aae066-d619-477c-93e3-3fb83b2d23c3
+version: 1
+date: '2020-04-02'
+author: Rico Valdez, Splunk
+type: Investigation
+datamodel: []
+description: This search returns all okta events from a specific IP address.
+search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country,
+  client.geographicalContext.state as state, client.geographicalContext.city as city
+  | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+how_to_implement: You must be ingesting Okta logs
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Suspicious Okta Activity
@@ -28,5 +29,3 @@ tags:
  - result
  - outcome.reason
  security_domain: network
-type: Investigation
-version: 1
@@ -1,16 +1,17 @@
-author: Rico Valdez, Splunk
-datamodel: []
-date: '2020-04-02'
-description: This search returns all okta events by a specific user
-how_to_implement: You must be ingesting Okta logs
-id: 24ff145d-4d16-420a-b047-480f2a51c403
-inputs:
- user
-known_false_positives: ''
 name: Investigate User Activities In Okta
-search: '`okta` user=$user$ | rename client.geographicalContext.country
-  as country, client.geographicalContext.state as state, client.geographicalContext.city
-  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+id: 24ff145d-4d16-420a-b047-480f2a51c403
+version: 1
+date: '2020-04-02'
+author: Rico Valdez, Splunk
+type: Investigation
+datamodel: []
+description: This search returns all okta events by a specific user
+search: '`okta` user=$user$ | rename client.geographicalContext.country as country,
+  client.geographicalContext.state as state, client.geographicalContext.city as city
+  | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+how_to_implement: You must be ingesting Okta logs
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Suspicious Okta Activity
@@ -27,5 +28,3 @@ tags:
  - result
  - outcome.reason
  security_domain: network
-type: Investigation
-version: 1
@@ -22,10 +22,10 @@ references: []
 tags:
  analytic_story:
  - AWS User Monitoring
-  detections:
-  - Detect new API calls from user roles
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect new API calls from user roles
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -37,4 +37,4 @@ tags:
  - userIdentity.type
  - userName
  - eventName
-  security_domain: network
+  security_domain: network
@@ -22,10 +22,10 @@ references: []
 tags:
  analytic_story:
  - AWS Cross Account Activity
-  detections:
-  - AWS Cross Account Activity From Previously Unseen Account
  deployments:
  - Daily Cache Updates
+  detections:
+  - AWS Cross Account Activity From Previously Unseen Account
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -35,4 +35,4 @@ tags:
  - eventName
  - userIdentity.accountId
  - resources{}.accountId
-  security_domain: network
+  security_domain: network
@@ -42,4 +42,4 @@ tags:
  - Authentication.user
  - Authentication.src
  - Authentication.user_role
-  security_domain: network
+  security_domain: network
@@ -43,4 +43,4 @@ tags:
  - Authentication.user
  - Authentication.src
  - Authentication.user_role
-  security_domain: network
+  security_domain: network
@@ -20,13 +20,13 @@ references: []
 tags:
  analytic_story:
  - AWS Suspicious Provisioning Activities
+  deployments:
+  - Daily Cache Updates
  detections:
  - AWS Cloud Provisioning From Previously Unseen IP Address
  - AWS Cloud Provisioning From Previously Unseen City
  - AWS Cloud Provisioning From Previously Unseen Country
  - AWS Cloud Provisioning From Previously Unseen Region
-  deployments:
-  - Daily Cache Updates
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -35,4 +35,4 @@ tags:
  - _time
  - eventName
  - sourceIPAddress
-  security_domain: network
+  security_domain: network
@@ -20,10 +20,10 @@ tags:
  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
-  detections:
-  - EC2 Instance Started In Previously Unseen Region
  deployments:
  - Daily Cache Updates
+  detections:
+  - EC2 Instance Started In Previously Unseen Region
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -31,4 +31,4 @@ tags:
  required_fields:
  - _time
  - awsRegion
-  security_domain: network
+  security_domain: network
@@ -37,4 +37,4 @@ tags:
  - All_Changes.status
  - All_Changes.user
  - All_Changes.command
-  security_domain: network
+  security_domain: network
@@ -39,4 +39,4 @@ tags:
  - All_Changes.status
  - All_Changes.user
  - All_Changes.command
-  security_domain: network
+  security_domain: network
@@ -33,4 +33,4 @@ tags:
  - All_Changes.action
  - All_Changes.object_category
  - All_Changes.user
-  security_domain: network
+  security_domain: network
@@ -36,4 +36,4 @@ tags:
  - All_Changes.action
  - All_Changes.object_category
  - All_Changes.user
-  security_domain: network
+  security_domain: network
@@ -34,4 +34,4 @@ tags:
  - _time
  - All_Changes.action
  - All_Changes.Instance_Changes.image_id
-  security_domain: network
+  security_domain: network
@@ -35,4 +35,4 @@ tags:
  - _time
  - All_Changes.action
  - All_Changes.Instance_Changes.image_id
-  security_domain: network
+  security_domain: network
@@ -33,4 +33,4 @@ tags:
  - _time
  - All_Changes.action
  - All_Changes.Instance_Changes.instance_type
-  security_domain: network
+  security_domain: network
@@ -35,4 +35,4 @@ tags:
  - _time
  - All_Changes.action
  - All_Changes.Instance_Changes.instance_type
-  security_domain: network
+  security_domain: network
@@ -10,9 +10,9 @@ description: This search builds a table of previously seen users that have modif
  a cloud instance.
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2
-  c=success by All_Changes.user | `drop_dm_object_name("All_Changes")`
-  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
-  <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
+  c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats
+  min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <=
+  relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user'
 how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs
  and have the latest Change Datamodel accelerated.
 known_false_positives: none
@@ -35,4 +35,4 @@ tags:
  - All_Changes.change_type
  - All_Changes.status
  - All_Changes.user
-  security_domain: network
+  security_domain: network
@@ -39,4 +39,4 @@ tags:
  - All_Changes.change_type
  - All_Changes.status
  - All_Changes.user
-  security_domain: network
+  security_domain: network
@@ -41,4 +41,4 @@ tags:
  - All_Changes.action
  - All_Changes.src
  - All_Changes.status
-  security_domain: network
+  security_domain: network
@@ -46,4 +46,4 @@ tags:
  - All_Changes.action
  - All_Changes.src
  - All_Changes.status
-  security_domain: network
+  security_domain: network
@@ -35,4 +35,4 @@ tags:
  - _time
  - All_Changes.action
  - All_Changes.vendor_region
-  security_domain: network
+  security_domain: network
@@ -38,4 +38,4 @@ tags:
  - _time
  - All_Changes.action
  - All_Changes.vendor_region
-  security_domain: network
+  security_domain: network
@@ -18,10 +18,10 @@ references: []
 tags:
  analytic_story:
  - AWS Cryptomining
-  detections:
-  - EC2 Instance Started With Previously Unseen AMI
  deployments:
  - Daily Cache Updates
+  detections:
+  - EC2 Instance Started With Previously Unseen AMI
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -31,4 +31,4 @@ tags:
  - eventName
  - errorCode
  - requestParameters.instancesSet.items{}.imageId
-  security_domain: network
+  security_domain: network
@@ -18,10 +18,10 @@ references: []
 tags:
  analytic_story:
  - AWS Cryptomining
-  detections:
-  - EC2 Instance Started With Previously Unseen Instance Type
  deployments:
  - Daily Cache Updates
+  detections:
+  - EC2 Instance Started With Previously Unseen Instance Type
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -31,4 +31,4 @@ tags:
  - eventName
  - errorCode
  - requestParameters.instanceType
-  security_domain: network
+  security_domain: network
@@ -19,10 +19,10 @@ tags:
  analytic_story:
  - AWS Cryptomining
  - Suspicious AWS EC2 Activities
-  detections:
-  - EC2 Instance Started With Previously Unseen User
  deployments:
  - Daily Cache Updates
+  detections:
+  - EC2 Instance Started With Previously Unseen User
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -32,4 +32,4 @@ tags:
  - eventName
  - errorCode
  - requestParameters.instanceType
-  security_domain: network
+  security_domain: network
@@ -18,10 +18,10 @@ references: []
 tags:
  analytic_story:
  - Unusual AWS EC2 Modifications
-  detections:
-  - EC2 Instance Modified With Previously Unseen User
  deployments:
  - Daily Cache Updates
+  detections:
+  - EC2 Instance Modified With Previously Unseen User
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -30,4 +30,4 @@ tags:
  - _time
  - userIdentity.arn
  - errorCode
-  security_domain: network
+  security_domain: network
@@ -21,10 +21,10 @@ references: []
 tags:
  analytic_story:
  - Suspicious AWS S3 Activities
-  detections:
-  - Detect S3 access from a new IP
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect S3 access from a new IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -34,4 +34,4 @@ tags:
  - http_status
  - bucket_name
  - remote_ip
-  security_domain: network
+  security_domain: network
@@ -23,13 +23,13 @@ references: []
 tags:
  analytic_story:
  - Suspicious AWS Login Activities
+  deployments:
+  - Daily Cache Updates
  detections:
  - Detect AWS Console Login by User from New Country
  - Detect AWS Console Login by User from New Region
  - Detect AWS Console Login by User from New City
  - Detect new user AWS Console Login
-  deployments:
-  - Daily Cache Updates
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -39,4 +39,4 @@ tags:
  - eventName
  - userIdentity.arn
  - src
-  security_domain: network
+  security_domain: network
@@ -42,4 +42,4 @@ tags:
  - Authentication.signature
  - Authentication.user
  - Authentication.src
-  security_domain: network
+  security_domain: network
@@ -42,4 +42,4 @@ tags:
  - Authentication.signature
  - Authentication.user
  - Authentication.src
-  security_domain: network
+  security_domain: network
@@ -25,13 +25,13 @@ references: []
 tags:
  analytic_story:
  - Suspicious AWS Login Activities
+  deployments:
+  - Daily Cache Updates
  detections:
  - Detect AWS Console Login by User from New Country
  - Detect AWS Console Login by User from New Region
  - Detect AWS Console Login by User from New City
  - Detect new user AWS Console Login
-  deployments:
-  - Daily Cache Updates
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -41,4 +41,4 @@ tags:
  - eventName
  - userIdentity.arn
  - src
-  security_domain: network
+  security_domain: network
@@ -20,14 +20,14 @@ tags:
  - 'Emotet Malware  DHS Report TA18-201A '
  - Monitor for Unauthorized Software
  - SamSam Ransomware
-  detections:
-  - Prohibited Software On Endpoint
  deployments:
  - Daily Cache Updates
+  detections:
+  - Prohibited Software On Endpoint
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
-  security_domain: endpoint
+  security_domain: endpoint
@@ -0,0 +1,71 @@
+name: 7zip CommandLine To SMB Share Path
+id: 01d29b48-ff6f-11eb-b81e-acde48001122
+version: 1
+date: '2021-08-17'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious 7z process with commandline pointing
+  to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z
+  to archive a sensitive files and place it in network share tmp folder. This search
+  is a good hunting query that may give analyst a hint why specific user try to archive
+  a file pointing to SMB user which is un usual.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe"
+  OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe"
+  OR Processes.original_file_name =  "7za.exe") AND (Processes.process="*\\C$\\*"
+  OR Processes.process="*\\Admin$\\*" OR Processes.process="*\\IPC$\\*") by Processes.original_file_name
+  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
+  Processes.parent_process_id Processes.process_id  Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `7zip_commandline_to_smb_share_path_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
+known_false_positives: unknown
+references:
+- https://threadreaderapp.com/thread/1423361119926816776.html
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1560.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: archive process $process_name$ with suspicious cmdline $process$ in host
+    $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed
@@ -1,16 +1,17 @@
-author: Rico Valdez, Splunk
-datamodel: []
+name: All backup logs for host
+id: bc91a8cf-aaaa-4bb2-8140-e756cc06fd72
+version: 1
 date: '2017-09-12'
+author: Rico Valdez, Splunk
+type: Investigation
+datamodel: []
 description: Retrieve the backup logs for the last 2 weeks for a specific host in
  order to investigate why backups are not completing successfully.
+search: '| search `netbackup` dest=$dest$'
 how_to_implement: The successfully implement this search you must first send your
  backup logs to Splunk.
-id: bc91a8cf-aaaa-4bb2-8140-e756cc06fd72
-inputs:
- dest
 known_false_positives: none
-name: All backup logs for host
-search: '| search `netbackup` dest=$dest$'
+references: []
 tags:
  analytic_story:
  - Monitor Backup Solution
@@ -20,5 +21,3 @@ tags:
  - _time
  - dest
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -10,10 +10,11 @@ description: The following analytic identifies suspicious PowerShell command to
  inbound traffic inbound to a specific local port within the public profile. This
  technique was seen in some attacker want to have a remote access to a machine by
  allowing the traffic in firewall rule.
-search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message
-  = "*Inbound*" Message = "*Allow*"  Message = "*-LocalPort*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`'
+search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Inbound*" Message = "*Allow*"  Message = "*-LocalPort*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `allow_inbound_traffic_in_firewall_rule_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the powershell logs  from your endpoints. make sure you enable needed
  registry to monitor this event.
@@ -34,11 +34,11 @@ tags:
  - Suspicious Command-Line Executions
  - Suspicious MSHTA Activity
  - Unusual Processes
+  deployments:
+  - Daily Cache Updates
  detections:
  - Detect Prohibited Applications Spawning cmd.exe
  - Unusually Long Command Line - MLTK
-  deployments:
-  - Daily Cache Updates
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -49,4 +49,4 @@ tags:
  - Processes.dest
  - Processes.process_name
  - Processes.process
-  security_domain: endpoint
+  security_domain: endpoint
@@ -19,10 +19,10 @@ references: []
 tags:
  analytic_story:
  - Asset Tracking
-  detections:
-  - Detect Unauthorized Assets by MAC address
  deployments:
  - Daily Cache Updates
+  detections:
+  - Detect Unauthorized Assets by MAC address
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -31,4 +31,4 @@ tags:
  - _time
  - Identity_Management.All_Assets
  - category
-  security_domain: endpoint
+  security_domain: endpoint
@@ -0,0 +1,59 @@
+name: Fsutil Zeroing File
+id: 4e5e024e-fabb-11eb-8b8f-acde48001122
+version: 1
+date: '2021-08-11'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious fsutil process to zeroing a target
+  file. This technique was seen in lockbit ransomware where it tries to zero out its
+  malware path as part of its defense evasion after encrypting the compromised host.
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe
+  Processes.process="*setzerodata*" by Processes.user Processes.process_name Processes.parent_process_name
+  Processes.dest  Processes.process Processes.parent_process | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fsutil_zeroing_file_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1070
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.process
+  - Processes.parent_process
+  security_domain: endpoint
+  impact: 60
+  confidence: 90
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Possible file data deletion on $dest$ using $process$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed
@@ -1,16 +1,17 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: Get Backup Logs For Endpoint
+id: fdcfb369-1725-4c24-824a-22972d7f0d44
+version: 1
 date: '2017-09-14'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search will tell you the backup status from your netbackup_logs
  of a specific endpoint for the last week.
+search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as
+  signature | table _time, dest, signature'
 how_to_implement: You must be ingesting your backup logs.
-id: fdcfb369-1725-4c24-824a-22972d7f0d44
-inputs:
- dest
 known_false_positives: ''
-name: Get Backup Logs For Endpoint
-search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME
-  as dest, MESSAGE as signature | table _time, dest, signature'
+references: []
 tags:
  analytic_story:
  - Ransomware
@@ -22,5 +23,3 @@ tags:
  - COMPUTERNAME
  - MESSAGE
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -1,18 +1,19 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: Get Logon Rights Modifications For Endpoint
+id: 03bffe94-ec7a-4cbe-b677-6af40d1c4505
+version: 2
 date: '2017-09-12'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search allows you to retrieve any modifications to logon rights
  associated with a specific host.
+search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$
+  | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right,
+  signature'
 how_to_implement: To successfully implement this search you must be ingesting your
  Windows event logs
-id: 03bffe94-ec7a-4cbe-b677-6af40d1c4505
-inputs:
- dest
 known_false_positives: ''
-name: Get Logon Rights Modifications For Endpoint
-search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717)
-  dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified",
-  Access_Right, signature'
+references: []
 tags:
  analytic_story:
  - Account Monitoring and Controls
@@ -24,5 +25,3 @@ tags:
  - dest
  - user
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,18 +1,19 @@
-author: David Dorsey, Splunk
-datamodel: []
+name: Get Logon Rights Modifications For User
+id: 552bc86c-f72c-4d44-b3f2-06ede13af7bb
+version: 2
 date: '2019-02-27'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel: []
 description: This search allows you to retrieve any modifications to logon rights
  for a specific user account.
+search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$
+  | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right,
+  signature'
 how_to_implement: To successfully implement this search you must be ingesting your
  Windows event logs
-id: 552bc86c-f72c-4d44-b3f2-06ede13af7bb
-inputs:
- user
 known_false_positives: ''
-name: Get Logon Rights Modifications For User
-search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717)
-  user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified",
-  Access_Right, signature'
+references: []
 tags:
  analytic_story:
  - Account Monitoring and Controls
@@ -24,5 +25,3 @@ tags:
  - dest
  - user
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,18 +1,19 @@
-author: Bhavin Patel, Splunk
-datamodel: []
+name: Get Notable History
+id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
+version: 2
 date: '2017-09-20'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel: []
 description: This search queries the notable index and returns all the Notable Events
  for the particular destination host, giving the analyst an overview of the incidents
  that may have occurred with the host under investigation.
-how_to_implement: If you are using Enterprise Security you are likely already creating
-  notable events with your correlation rules. No additional configuration is necessary.
-id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
-inputs:
- dest
-known_false_positives: ''
-name: Get Notable History
 search: '| search `notable` | search dest=$dest$ | table _time, dest, rule_name, owner,
  priority, severity, status_description'
+how_to_implement: If you are using Enterprise Security you are likely already creating
+  notable events with your correlation rules. No additional configuration is necessary.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - AWS Cross Account Activity
@@ -89,5 +90,3 @@ tags:
  required_fields:
  - _time
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,25 +1,25 @@
-author: Bhavin Patel, Splunk
-datamodel: 
- Endpoint
+name: Get Parent Process Info
+id: fecf2918-670d-4f1c-872b-3d7317a41bf9
+version: 2
 date: '2019-02-28'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel:
+- Endpoint
 description: This search queries the Endpoint data model to give you details about
  the parent process of a process running on a host which is under investigation.
  Enter the values of the process name in question and the dest
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
+  by Processes.user Processes.parent_process_name Processes.process_name Processes.dest
+  | `drop_dm_object_name("Processes")` | search  parent_process_name= $parent_process_name$
+  |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
-id: fecf2918-670d-4f1c-872b-3d7317a41bf9
-inputs:
- parent_process_name
- dest
 known_false_positives: ''
-name: Get Parent Process Info
-search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time)
-  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user
-  Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")`
-  | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`'
+references: []
 tags:
  analytic_story:
  - Collection and Staging
@@ -59,5 +59,3 @@ tags:
  - Processes.process_name
  - Processes.dest
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,23 +1,23 @@
-author: David Dorsey, Splunk
-datamodel: 
- Endpoint
+name: Get Process File Activity
+id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5
+version: 2
 date: '2019-11-06'
+author: David Dorsey, Splunk
+type: Investigation
+datamodel:
+- Endpoint
 description: This search returns the file activity for a specific process on a specific
  endpoint
-how_to_implement: To successfully implement this search you must be ingesting endpoint
-  data and populating the Endpoint data model.
-id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5
-inputs:
- process_name
- dest
-known_false_positives: ''
-name: Get Process File Activity
 search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as
  file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name
  from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path,
  Filesystem.action, _time | `drop_dm_object_name(Filesystem)`  | search dest=$dest$  |
  search process_name=$process_name$ | table _time, process_name, dest, action, file_name,
  file_path'
+how_to_implement: To successfully implement this search you must be ingesting endpoint
+  data and populating the Endpoint data model.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - DHS Report TA18-074A
@@ -32,5 +32,3 @@ tags:
  - Filesystem.file_path
  - Filesystem.action
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,23 +1,23 @@
-author: Bhavin Patel, Splunk
-datamodel: 
- Endpoint
+name: Get Process Info
+id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
+version: 2
 date: '2019-04-01'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel:
+- Endpoint
 description: This search queries the Endpoint data model to give you details about
  the process running on a host which is under investigation. To gather the process
  info, enter the values for the process name in question and the destination IP address.
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
+  by Processes.user Processes.parent_process_name Processes.process_name Processes.dest
+  | `drop_dm_object_name("Processes")` | search  process_name= $process_name$ | search
+  dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 how_to_implement: To successfully implement this search you must be ingesting endpoint
  data and populating the Endpoint data model.
-id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
-inputs:
- process_name
- dest
 known_false_positives: ''
-name: Get Process Info
-search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time)
-  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user
-  Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")`
-  | search  process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`'
+references: []
 tags:
  analytic_story:
  - AWS Network ACL Activity
@@ -59,5 +59,3 @@ tags:
  - Processes.process_name
  - Processes.dest
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,17 +1,13 @@
-author: Bhavin Patel, Splunk
-datamodel: 
- Endpoint
+name: Get Process Information For Port Activity
+id: 9925d08f-561e-4faa-8912-e3888a842341
+version: 2
 date: '2019-04-01'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel:
+- Endpoint
 description: This search will return information about the process associated with
  observed network traffic to a specific destination port from a specific host.
-how_to_implement: To successfully implement this search you must be ingesting endpoint
-  data that associates processes with network events and populate the Endpoint Datamodel
-id: 9925d08f-561e-4faa-8912-e3888a842341
-inputs:
- dest_port
- dest
-known_false_positives: ''
-name: Get Process Information For Port Activity
 search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as
  lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user
  Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
@@ -19,6 +15,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) max(_time) a
  [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by
  Ports.process_id Ports.src Ports.dest_port | `drop_dm_object_name(Ports)` | search
  dest_port=$dest_port$ | rename src as dest]'
+how_to_implement: To successfully implement this search you must be ingesting endpoint
+  data that associates processes with network events and populate the Endpoint Datamodel
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - AWS Network ACL Activity
@@ -44,5 +44,3 @@ tags:
  - Ports.src
  - Ports.dest_port
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,19 +1,15 @@
-author: Bhavin Patel, Splunk
-datamodel: 
- Endpoint
+name: Get Process Responsible For The DNS Traffic
+id: 910e6512-edc9-4f93-ba24-5b786f47a672
+version: 2
 date: '2019-04-01'
+author: Bhavin Patel, Splunk
+type: Investigation
+datamodel:
+- Endpoint
 description: While investigating, an analyst will want to know what process and parent_process
  is responsible for generating suspicious DNS traffic. Use the following search and
  enter the value of `dest` in the search to get specific details on the process responsible
  for creating the DNS traffic.
-how_to_implement: You must be ingesting endpoint data that associates processes with
-  network events into the Endpoint datamodel. This can come from endpoint protection
-  products such as carbon black, or endpoint data sources such as Sysmon.
-id: 910e6512-edc9-4f93-ba24-5b786f47a672
-inputs:
- dest
-known_false_positives: ''
-name: Get Process Responsible For The DNS Traffic
 search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as
  lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name
  Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)`
@@ -21,6 +17,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) max(_time) a
  dest = $dest$ | join dest type=inner [| tstats `security_content_summariesonly`
  count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id
  Ports.src | `drop_dm_object_name(Ports)` | rename src as dest]'
+how_to_implement: You must be ingesting endpoint data that associates processes with
+  network events into the Endpoint datamodel. This can come from endpoint protection
+  products such as carbon black, or endpoint data sources such as Sysmon.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - AWS Network ACL Activity
@@ -44,5 +45,3 @@ tags:
  - Ports.src
  - Ports.dest_port
  security_domain: endpoint
-type: Investigation
-version: 2
@@ -1,20 +1,19 @@
-author: Rico Valdez, Splunk
-datamodel: []
+name: Get Sysmon WMI Activity for Host
+id: 155e0571-7db6-42f2-aa62-9a3a4cf35c94
+version: 1
 date: '2018-10-23'
+author: Rico Valdez, Splunk
+type: Investigation
+datamodel: []
 description: This search queries Sysmon WMI events for the host of interest.
+search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$|
+  table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter'
 how_to_implement: To successfully implement this search, you must be collecting Sysmon
  data using Sysmon version 6.1 or greater and have Sysmon configured to generate
  events for WMI activity. In addition, you must have at least version 6.0.4 of the
  Sysmon TA installed to properly parse the fields.
-id: 155e0571-7db6-42f2-aa62-9a3a4cf35c94
-inputs:
- process
- dest
 known_false_positives: ''
-name: Get Sysmon WMI Activity for Host
-search: '`sysmon` EventCode>18
-  EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user,
-  Name, Operation, EventType, Type, Query, Consumer, Filter'
+references: []
 tags:
  analytic_story:
  - Ransomware
@@ -33,5 +32,3 @@ tags:
  - Consumer
  - Filter
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -16,14 +16,14 @@ how_to_implement: To successfully implement this search you must be ingesting en
 known_false_positives: none
 references: []
 tags:
+  deployments:
+  - Daily Cache Updates
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-  deployments:
-  - Daily Cache Updates
  required_fields:
  - _time
  - Processes.process_name
  - Processes.dest
-  security_domain: endpoint
+  security_domain: endpoint
@@ -1,21 +1,22 @@
-author: Patrick Bareiss, Splunk
-datamodel: 
- Authentication
-date: '2019-12-10'
-description: This search returns failed logins to multiple destinations by user.
-how_to_implement: To successfully implement this search you need to be ingesting authentication
-  logs from your various systems and populating the Authentication data model.
-id: 097e8030-8662-4254-a735-bf0bdda696e3
-inputs:
- user
-known_false_positives: ''
 name: Investigate Failed Logins for Multiple Destinations
+id: 097e8030-8662-4254-a735-bf0bdda696e3
+version: 1
+date: '2019-12-10'
+author: Patrick Bareiss, Splunk
+type: Investigation
+datamodel:
+- Authentication
+description: This search returns failed logins to multiple destinations by user.
 search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login
  latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest)
  AS Authentication.dest values(Authentication.app) AS Authentication.app  from datamodel=Authentication
  where Authentication.action=failure by Authentication.user | where distinct_count_dest
  > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)`
  | `drop_dm_object_name("Authentication")` | search user=$user$'
+how_to_implement: To successfully implement this search you need to be ingesting authentication
+  logs from your various systems and populating the Authentication data model.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Credential Dumping
@@ -28,5 +29,3 @@ tags:
  - Authentication.action
  - Authentication.user
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -1,22 +1,23 @@
-author: Patrick Bareiss, Splunk
-datamodel: []
+name: Investigate Pass the Hash Attempts
+id: ed3fff45-cba6-4990-983f-6fac72bee659
+version: 1
 date: '2019-12-10'
+author: Patrick Bareiss, Splunk
+type: Investigation
+datamodel: []
 description: This search hunts for dumped NTLM hashes used for pass the hash.
+search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate
+  | stats count earliest(_time) as first_login latest(_time) as last_login by src_user
+  dest | `security_content_ctime(first_login)` | `security_content_ctime(last_login)`
+  | search dest=$dest$'
 how_to_implement: To successfully implement this search you need be ingesting windows
  security logs. This search uses an input macro named `wineventlog_security`. We
  strongly recommend that you specify your environment-specific configurations (index,
  source, sourcetype, etc.) for Windows Security logs. Replace the macro definition
  with configurations for your Splunk environment. The search also uses a post-filter
  macro designed to filter out known false positives.
-id: ed3fff45-cba6-4990-983f-6fac72bee659
-inputs:
- dest
 known_false_positives: ''
-name: Investigate Pass the Hash Attempts
-search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate
-  | stats count earliest(_time) as first_login latest(_time) as last_login by src_user
-  dest | `security_content_ctime(first_login)` | `security_content_ctime(last_login)`
-  | search dest=$dest$'
+references: []
 tags:
  analytic_story:
  - Credential Dumping
@@ -30,5 +31,3 @@ tags:
  - src_user
  - dest
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -1,22 +1,23 @@
-author: Patrick Bareiss, Splunk
-datamodel: []
+name: Investigate Pass the Ticket Attempts
+id: 990007ad-d798-4b29-ab2f-f0034144c937
+version: 1
 date: '2019-12-10'
+author: Patrick Bareiss, Splunk
+type: Investigation
+datamodel: []
 description: This search hunts for dumped kerberos ticket from LSASS memory.
+search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user
+  "(?<new_user>[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count)
+  AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where
+  sum_count/max_count!=2 | rename new_user AS user '
 how_to_implement: To successfully implement this search you need to be ingesting windows
  security logs. This search uses an input macro named `wineventlog_security`. We
  strongly recommend that you specify your environment-specific configurations (index,
  source, sourcetype, etc.) for Windows Security logs. Replace the macro definition
  with configurations for your Splunk environment. The search also uses a post-filter
  macro designed to filter out known false positives.
-id: 990007ad-d798-4b29-ab2f-f0034144c937
-inputs:
- dest
 known_false_positives: ''
-name: Investigate Pass the Ticket Attempts
-search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user
-  "(?<new_user>[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count)
-  AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where
-  sum_count/max_count!=2 | rename new_user AS user '
+references: []
 tags:
  analytic_story:
  - Credential Dumping
@@ -28,5 +29,3 @@ tags:
  - user
  - dest
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -1,16 +1,13 @@
-author: Patrick Bareiss, Splunk
-datamodel: 
- Authentication
+name: Investigate Previous Unseen User
+id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad
+version: 1
 date: '2019-12-10'
+author: Patrick Bareiss, Splunk
+type: Investigation
+datamodel:
+- Authentication
 description: This search returns previous unseen user, which didn't log in for 30
  days.
-how_to_implement: To successfully implement this search you need to be ingesting authentication
-  logs from your various systems and populating the Authentication data model.
-id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad
-inputs:
- dest
-known_false_positives: ''
-name: Investigate Previous Unseen User
 search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login
  latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app)
  AS Authentication.app values(Authentication.action) AS Authentication.action from
@@ -20,6 +17,10 @@ search: '| tstats count `security_content_summariesonly` earliest(_time) as firs
  | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)`
  | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")`
  | search dest=$dest$'
+how_to_implement: To successfully implement this search you need to be ingesting authentication
+  logs from your various systems and populating the Authentication data model.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Credential Dumping
@@ -32,5 +33,3 @@ tags:
  - Authentication.action
  - Authentication.user
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -1,17 +1,14 @@
-author: Jose Hernandez, Splunk
-datamodel: 
- Authentication
+name: Investigate Successful Remote Desktop Authentications
+id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc
+version: 1
 date: '2018-12-14'
+author: Jose Hernandez, Splunk
+type: Investigation
+datamodel:
+- Authentication
 description: 'This search returns the source, destination, and user for all successful
  remote-desktop authentications. A successful authentication after a brute-force
  attack on a destination machine is suspicious behavior. '
-how_to_implement: You must be populating the Authentication data model with security
-  events from your Windows event logs.
-id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc
-inputs:
- dest
-known_false_positives: ''
-name: Investigate Successful Remote Desktop Authentications
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Authentication where Authentication.signature_id=4624
  Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app
@@ -19,6 +16,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")`
  | search dest=$dest$ | table firstTime lastTime src src_nt_domain dest user app
  count | sort count'
+how_to_implement: You must be populating the Authentication data model with security
+  events from your Windows event logs.
+known_false_positives: ''
+references: []
 tags:
  analytic_story:
  - Hidden Cobra Malware
@@ -36,5 +37,3 @@ tags:
  - Authentication.signature
  - Authentication.src_nt_domain
  security_domain: endpoint
-type: Investigation
-version: 1
@@ -18,14 +18,14 @@ references: []
 tags:
  analytic_story:
  - Monitor Backup Solution
+  deployments:
+  - Daily Cache Updates
  detections:
  - Unsuccessful Netbackup backups
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
-  deployments:
-  - Daily Cache Updates
  required_fields:
  - _time
-  security_domain: endpoint
+  security_domain: endpoint
@@ -17,14 +17,14 @@ references: []
 tags:
  analytic_story:
  - Monitor Backup Solution
-  detections:
-  - Unsuccessful Netbackup backups
  deployments:
  - Daily Cache Updates
+  detections:
+  - Unsuccessful Netbackup backups
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
-  security_domain: endpoint
+  security_domain: endpoint
@@ -0,0 +1,59 @@
+name: Powershell Execute COM Object
+id: 65711630-f9bf-11eb-8d72-acde48001122
+version: 1
+date: '2021-08-10'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a COM CLSID execution through powershell. This
+  technique was seen in several adversaries and malware like ransomware conti where
+  it has a feature to execute command using COM Object. This technique may use by
+  network operator at some cases but a good indicator if some application want to
+  gain privilege escalation or bypass uac.
+search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*"
+  OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network operrator may use this command.
+references:
+- https://threadreaderapp.com/thread/1423361119926816776.html
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1546.015
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 10
+  confidence: 50
+  risk_score: 5
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  message: A suspicious powershell script contains COM CLSID command in $Message$
+    with EventCode $EventCode$ in host $ComputerName$
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed
@@ -30,10 +30,10 @@ tags:
  - Suspicious Command-Line Executions
  - Suspicious MSHTA Activity
  - Icedid
-  detections:
-  - First time seen command line argument
  deployments:
  - Daily Cache Updates
+  detections:
+  - First time seen command line argument
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -42,4 +42,4 @@ tags:
  - _time
  - Processes.process_name
  - Processes.process
-  security_domain: endpoint
+  security_domain: endpoint
@@ -32,4 +32,4 @@ tags:
  - _time
  - EventCode
  - Message
-  security_domain: endpoint
+  security_domain: endpoint
@@ -37,4 +37,4 @@ tags:
  - _time
  - EventCode
  - Message
-  security_domain: endpoint
+  security_domain: endpoint
@@ -35,4 +35,4 @@ tags:
  - Processes.parent_process_name
  - Processes.process_name
  - Processes.dest
-  security_domain: endpoint
+  security_domain: endpoint
@@ -40,4 +40,4 @@ tags:
  - Processes.parent_process_name
  - Processes.process_name
  - Processes.dest
-  security_domain: endpoint
+  security_domain: endpoint
@@ -0,0 +1,66 @@
+name: Rundll32 LockWorkStation
+id: fa90f372-f91d-11eb-816c-acde48001122
+version: 1
+date: '2021-08-09'
+author: Teoderick Contreras, Splunk
+type: Investigation
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious rundll32 commandline to lock the
+  workstation through command line. This technique was seen in CONTI leak tooling
+  and script as part of its defense evasion. This technique is not a common practice
+  to lock a screen and maybe a good indicator of compromise.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://threadreaderapp.com/thread/1423361119926816776.html
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: process $process_name$ with cmdline $process$ in host $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed
@@ -31,10 +31,20 @@ tags:
  cis20:
  - CIS 16
  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log
+  impact: 90
  kill_chain_phases:
  - Actions on Objectives
+  message: Mimikatz malware is violating authentication processes by injecting golden
+    or silver Kerberos tickets or passing stolen authentication tokens. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
  mitre_attack_id:
  - T1055
  - T1068
@@ -50,23 +60,6 @@ tags:
  nist:
  - PR.AC
  - PR.IP
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - dest_user_id
-  - process
-  - _time
-  risk_severity: high
-  security_domain: endpoint
-  message: Mimikatz malware is violating authentication processes by injecting golden or silver Kerberos tickets or passing stolen authentication tokens. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
-  risk_score: 90
-  impact: 90
-  confidence: 100
-  context:
-  - Source:AD
-  - Source:Endpoint
-  - Stage:Credential Access
  observable:
  - name: dest_user_id
    type: User
@@ -80,4 +73,13 @@ tags:
    type: processname
    role:
    - Others
-
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
@@ -35,10 +35,20 @@ tags:
  cis20:
  - CIS 16
  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
+  impact: 90
  kill_chain_phases:
  - Actions on Objectives
+  message: PowerSploit malware is violating authentication by injecting stolen credentials,
+    manipulating authentication tokens or impersonating system or user accounts. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
  mitre_attack_id:
  - T1055
  - T1068
@@ -54,23 +64,6 @@ tags:
  nist:
  - PR.AC
  - PR.IP
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - dest_user_id
-  - process
-  - _time
-  risk_severity: high
-  security_domain: endpoint
-  message: PowerSploit malware is violating authentication by injecting stolen credentials, manipulating authentication tokens or impersonating system or user accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
-  risk_score: 90
-  impact: 90
-  confidence: 100
-  context:
-  - Source:AD
-  - Source:Endpoint
-  - Stage:Credential Access
  observable:
  - name: dest_user_id
    type: User
@@ -84,4 +77,13 @@ tags:
    type: processname
    role:
    - Others
-
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
@@ -30,8 +30,17 @@ tags:
  cis20:
  - CIS 16
  - CIS 20
+  confidence: 85
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Credential Access
+  impact: 30
  kill_chain_phases:
  - Actions on Objectives
+  message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
+    Account attempting this operation is $dest_user_id$ via command $cmd_line$
  mitre_attack_id:
  - T1078
  - T1098
@@ -42,24 +51,6 @@ tags:
  nist:
  - PR.AC
  - PR.IP
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - process
-  - dest_device_id
-  - dest_user_id
-  risk_severity: high
-  security_domain: endpoint
-  message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. Account attempting this operation is $dest_user_id$ via command $cmd_line$
-  risk_score: 25
-  impact: 30
-  confidence: 85
-  context:
-  - Source:AD
-  - Source:Endpoint
-  - Stage:Recon
-  - Stage:Credential Access
  observable:
  - name: dest_user_id
    type: User
@@ -73,3 +64,13 @@ tags:
    type: processname
    role:
    - Others
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 25
+  risk_severity: high
+  security_domain: endpoint
@@ -34,30 +34,21 @@ tags:
  - CIS 3
  - CIS 5
  - CIS 16
-  kill_chain_phases:
-  - Actions on Objectives
-  mitre_attack_id:
-  - T1003
-  nist:
-  - DE.CM
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - process_name
-  - _time
-  - dest_device_id
-  - dest_user_id
-  - process
-  risk_severity: low
-  security_domain: endpoint
-  message: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
-  risk_score: 63
-  impact: 70
  confidence: 90
  context:
  - Source:AD
  - Source:Endpoint
  - Stage:Credential Access
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Malicious actor is dumping stored credentials from the registry sections
+    SAM, Security, or System. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - DE.CM
  observable:
  - name: dest_user_id
    type: User
@@ -71,3 +62,14 @@ tags:
    type: processname
    role:
    - Others
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  - process
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
@@ -41,35 +41,24 @@ tags:
  asset_type: Windows
  cis20:
  - CIS 16
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
-  kill_chain_phases:
-  - Actions on Objectives
-  mitre_attack_id:
-  - T1003
-  nist:
-  - PR.AC
-  - PR.IP
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - _time
-  - process_path
-  - dest_user_id
-  - process
-  risk_severity: high
-  security_domain: endpoint
-  message: DSInternals tool kit is converting stolen credential material to a form applicable to authentications. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
-  risk_score: 70
-  impact: 70
  confidence: 100
  context:
  - Source:AD
  - Source:Endpoint
  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DSInternals tool kit is converting stolen credential material to a form
+    applicable to authentications. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
  observable:
  - name: dest_user_id
    type: User
@@ -83,3 +72,16 @@ tags:
    type: processname
    role:
    - Others
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - _time
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 70
+  risk_severity: high
+  security_domain: endpoint
--- a/Show More
+++ b/Show More