From de016c4686406d2261413a9b702dce56c93a07b2 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-34-63>
Date: Thu, 5 Aug 2021 13:45:14 +0000
Subject: [PATCH] Added detection testing service results inRundll32 Process
 Creating Exe Dll Files

---
 ...undll32_process_creating_exe_dll_files.yml | 34 +++++++++----------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
index 8267b00feb..48cc4f7668 100644
--- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
+++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
@@ -6,15 +6,14 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files.
-  this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable 
-  drop it either appdata or programdata as part of its execution.
-search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",)
-  | stats count min(_time) as firstTime max(_time) as lastTime
-  by Image TargetFilename ProcessGuid dest user_id 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `rundll32_process_creating_exe_dll_files_filter`'
+description: This search is to detect a suspicious rundll32 process that drops executable
+  (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries
+  to drop copy of itself in temp folder or download executable drop it either appdata
+  or programdata as part of its execution.
+search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe",
+  "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image
+  TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, TargetFilename, and eventcode 11 executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -37,22 +36,21 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Image 
-  - TargetFilename 
-  - ProcessGuid 
-  - dest 
-  - user_id 
+  - Image
+  - TargetFilename
+  - ProcessGuid
+  - dest
+  - user_id
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
-  - source: endpoint 
+  - source: endpoint
   - stage: Defense Evasion
   message: rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$
   observable:
-  - name: Computer 
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -60,4 +58,4 @@ tags:
     type: process name
     role:
     - Attacker
-  
\ No newline at end of file
+  automated_detection_testing: passed