tested and updates searches for lateral movement story

detections/remote_desktop_process_running_on_system.yml

@@ -29,14 +29,17 @@ detect:
         risk_object_type:
           - system
         risk_score: 40
+      macros:
+        - remote_desktop_process_running_on_system_filter
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
         latest_time: -10m@m
       search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
-        lastTime from datamodel=Endpoint.Processes where Processes.process=mstsc.exe
+        lastTime from datamodel=Endpoint.Processes where Processes.process=*mstsc.exe
         AND Processes.dest_category!=common_rdp_source by Processes.dest Processes.user
-        Processes.process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`'
+        Processes.process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+        | `drop_dm_object_name(Processes)` | `remote_desktop_process_running_on_system_filter` '
       suppress:
         suppress_fields: dest,user
         suppress_period: 28800s

detections/schtasks_scheduling_job_on_remote_system.yml

@@ -33,12 +33,12 @@ detect:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
         latest_time: -10m@m
-      search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time)
-        as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
-        Processes.process_name = schtasks.exe Processes.process="*/create*" Processes.process="*
-        /s *" by Processes.process_name Processes.parent_process_name Processes.dest
-        Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-        | `schtasks_scheduling_job_on_remote_system_filter` '
+      search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
+        from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe Processes.process="*/create*"
+        Processes.process="* /s *" by Processes.process_name Processes.process Processes.parent_process_name
+        Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+        | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+        | `schtasks_scheduling_job_on_remote_system_filter`'
       suppress:
         suppress_fields: dest,process
         suppress_period: 28800s

macros/remote_desktop_process_running_on_system_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters for remote desktop process running on system
+name: remote_desktop_process_running_on_system_filter