From 4978fdfc07dca8a96c6e860490cdd4c86579193d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 13 Sep 2022 12:53:25 -0600
Subject: [PATCH] Some fixes

---
 ...ss_token_manipulation_sedebugprivilege.yml | 15 ++++++-----
 ...lation_winlogon_duplicate_token_handle.yml | 25 ++++++++---------
 ...ogon_duplicate_handle_in_uncommon_path.yml | 22 ++++++++-------
 ...cement_modify_transcodedwallpaper_file.yml |  7 +++--
 ...cess_injection_with_public_source_path.yml | 27 ++++++++++---------
 .../windows_service_deletion_in_registry.yml  | 20 +++++++-------
 6 files changed, 59 insertions(+), 57 deletions(-)

diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
index 3d2193e6de..97d6002393 100644
--- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
+++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
@@ -7,9 +7,8 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. 
-  This technique was being abused by adversaries, threat actors and red-teamers to gain debug privileges on their malware process 
-  to be able to access or debug a process to dump credentials or to inject malicious code. This anomaly detection can be a good pivot 
-  to catch possible mimikatz, BRC4 or malware elevating their process privileges.
+  SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir.
+  This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code.
 search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*"))
   | stats count min(_time) as firstTime max(_time) as lastTime by ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action
   | `security_content_ctime(firstTime)`
@@ -18,10 +17,12 @@ search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugP
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also
   required.
-known_false_positives: we've seen normal process in system32 folder path and browser application doing this technique. 
-  Filter as needed.
+known_false_positives: Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
 references:
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703
+- https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
+- https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
+- https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
 tags:
   analytic_story:
   - Brute Ratel C4
@@ -39,7 +40,7 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: a process $Process_Name$ adjust its privileges with SeDebugPrivilege in $Computer$
+  message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $ComputerName$.
   mitre_attack_id:
   - T1134.002
   - T1134
@@ -56,7 +57,7 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Process_Name 
+  - ProcessName 
   - Security_ID 
   - action 
   - result 
diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
index 8d3048611d..cd80686ee5 100644
--- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
+++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
@@ -4,11 +4,9 @@ version: 1
 date: '2022-08-24'
 author: Teoderick Contreras, Splunk
 type: Hunting
-datamodel:
-- Endpoint
-description: The following analytic identifies a process access in winlogon.exe to duplicate its handle. 
-  This technique was seen in several adversaries, threat actors and even red teams to gain privileges to their process. 
-  This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance.
+datamodel: []
+description: The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle. 
+  This technique was seen in several adversaries to gain privileges for their process. 
   Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
 search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 
   | stats count min(_time) as firstTime max(_time) as lastTime 
@@ -16,12 +14,11 @@ search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` 
   | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: third party software application may do this technique.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
 references:
   - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
   - https://attack.mitre.org/techniques/T1134/001/
@@ -42,7 +39,7 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
+  message: A process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
   mitre_attack_id:
   - T1134.001
   - T1134
@@ -53,6 +50,10 @@ tags:
     type: Endpoint
     role:
     - Victim
+  - name: SourceImage
+    type: Process Name
+    role:
+    - Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
index 30b96f5a91..b46fcfda5b 100644
--- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
+++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
@@ -4,10 +4,9 @@ version: 1
 date: '2022-08-24'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-description: The following analytic identifies a process access in winlogon.exe to duplicate its handle with a non-common or public process source path. 
-  This technique was seen in several adversaries, threat actors and even red teams to gain privileges to their process. 
+datamodel: []
+description: The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path. 
+  This technique was seen where adversaries attempt to gain privileges to their process. 
   This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance.
   Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
 search: '`sysmon` EventCode=10  TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 
@@ -16,12 +15,11 @@ search: '`sysmon` EventCode=10  TargetImage IN("*\\system32\\winlogon.exe*", "*\
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` 
   | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: 3rd party software application may do this technique.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
 references:
   - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
   - https://attack.mitre.org/techniques/T1134/001/
@@ -53,6 +51,10 @@ tags:
     type: Endpoint
     role:
     - Victim
+  - name: SourceImage
+    type: Process Name
+    role:
+    - Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
index 3e41ad3494..0791d83312 100644
--- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
+++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
@@ -7,10 +7,9 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory 
-  to change the wallpaper of the host machine. This technique was seen in adversaries, threat actors and red-teaming tools to deface 
+  to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface 
   or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper 
-  if a user changes it via desktop personalized setting is explorer.exe. This Anomaly analytic can be a good pivot on a process that 
-  is not commonly used to change the wallpaper like ransomware.
+  if a user changes it via desktop personalized setting is explorer.exe.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" 
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid  Processes.original_file_name
   | `drop_dm_object_name(Processes)` 
@@ -53,7 +52,7 @@ tags:
   nist:
   - DE.CM
   observable:
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml
index b6093a36b8..c7adbab730 100644
--- a/detections/endpoint/windows_process_injection_with_public_source_path.yml
+++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml
@@ -3,23 +3,20 @@ id: 492f09cf-5d60-4d87-99dd-0bc325532dda
 version: 1
 date: '2022-08-24'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
-description: The following analytic identifies a process creating a remote thread in another process 
-  with a public or uncommon installation process file path. This Windows API is commonly used by threat actors, red-teamers and adversaries 
-  for process code injection to evade detections or gain privilege escalation.  
+type: Hunting
+datamodel: []
+description: The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries
+  for process injection to evade detections or gain privilege escalation.  
 search: '`sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
   | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid TargetProcessId SourceProcessId StartAddress EventCode Computer 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_process_injection_with_public_source_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: some security tool or 3rd party application may do this technique. Filter is needed.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+known_false_positives: Some security products or third party applications may utilize CreateRemoteThread, filter as needed before enabling as a notable.
 references:
 - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
 tags:
@@ -39,7 +36,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Exploitation
-  message: process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$
+  message: process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$
   mitre_attack_id:
   - T1055
   - T1055.002
@@ -54,6 +51,10 @@ tags:
     type: Process
     role:
     - Attacker
+  - name: TargetImage
+    type: Process
+    role:
+    - Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml
index 3488fefd77..aec113fbea 100644
--- a/detections/endpoint/windows_service_deletion_in_registry.yml
+++ b/detections/endpoint/windows_service_deletion_in_registry.yml
@@ -3,13 +3,11 @@ id: daed6823-b51c-4843-a6ad-169708f1323e
 version: 1
 date: '2022-08-24'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies a registry modification due to deleted services.
-  Red Teams, malicious actors and adversaries may delete a security service as part of its defense evasion.
-  The BRC4 red teaming tool is capable of deleting a services using native windows API that leave lesser noise 
-  and footprint in terms of process command-line detections.
+description: The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services. 
+  Adversaries may delete a service as part of defense evasion.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
   where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified))
   by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name Registry.action Registry.dest 
@@ -21,8 +19,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
   that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: this event can be seen when administrator delete a service or uninstall/reinstall a software that create service entry,
-  But it is still recommended to check this alert with high priority.
+known_false_positives: This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry,
+  but it is still recommended to check this alert with high priority.
 references:
 - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
 tags:
@@ -33,16 +31,16 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
-  confidence: 80
+  confidence: 30
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log
-  impact: 80
+  impact: 60
   kill_chain_phases:
   - Exploitation
-  message: a service registry $Registry.registry_path$ was deleted in $Registry.dest$
+  message: A service was deleted on $dest$ within the Windows registry.
   mitre_attack_id:
   - T1489
   nist:
@@ -70,5 +68,5 @@ tags:
   - Processes.parent_process_name
   - Processes.parent_process
   - Processes.process_guid
-  risk_score: 64
+  risk_score: 18
   security_domain: endpoint