Merge branch 'icedid' of https://github.com/splunk/security_content into icedid

detections/endpoint/rundll32_process_creating_exe_dll_files.yml

@@ -6,15 +6,14 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files.
-  this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable 
-  drop it either appdata or programdata as part of its execution.
-search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",)
-  | stats count min(_time) as firstTime max(_time) as lastTime
-  by Image TargetFilename ProcessGuid dest user_id 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `rundll32_process_creating_exe_dll_files_filter`'
+description: This search is to detect a suspicious rundll32 process that drops executable
+  (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries
+  to drop copy of itself in temp folder or download executable drop it either appdata
+  or programdata as part of its execution.
+search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe",
+  "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image
+  TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, TargetFilename, and eventcode 11 executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -37,22 +36,21 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Image 
-  - TargetFilename 
-  - ProcessGuid 
-  - dest 
-  - user_id 
+  - Image
+  - TargetFilename
+  - ProcessGuid
+  - dest
+  - user_id
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
-  - source: endpoint 
+  - source: endpoint
   - stage: Defense Evasion
   message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$
   observable:
-  - name: Computer 
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -60,4 +58,4 @@ tags:
     type: process name
     role:
     - Attacker
-  
+  automated_detection_testing: passed