Branch was auto-updated.

detections/endpoint/cmd_echo_pipe___escalation.yml

@@ -0,0 +1,52 @@
+name: CMD Echo Pipe - Escalation
+id: eb277ba0-b96b-11eb-b00e-acde48001122
+version: 1
+date: '2021-05-20'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies a common behavior by Cobalt Strike and other
+  frameworks where the adversary will escalate privileges, either via `jump` (Cobalt
+  Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will
+  look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe
+  OR Processes.process=*%comspec%*) (Processes.process=*echo* AND Processes.process=*pipe*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Unknown. It is possible filtering may be required to ensure
+  fidelity.
+references:
+- https://redcanary.com/threat-detection-report/threats/cobalt-strike/
+- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1059.003
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_azurehound_command_line_arguments.yml

@@ -0,0 +1,55 @@
+name: Detect AzureHound Command-Line Arguments
+id: 26f02e96-c300-11eb-b611-acde48001122
+version: 1
+date: '2021-06-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the common command-line argument used
+  by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may
+  be modified, but these changes are dependent upon the operator. In most instances
+  the defaults are used. This analytic works to identify the common command-line attributes
+  used. It does not cover the entirety of every argument in order to avoid false positives.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Unknown.
+references:
+- https://attack.mitre.org/software/S0521/
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
+- https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1
+tags:
+  analytic_story:
+  - Discovery Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_azurehound_file_modifications.yml

@@ -0,0 +1,56 @@
+name: Detect AzureHound File Modifications
+id: 1c34549e-c31b-11eb-996b-acde48001122
+version: 1
+date: '2021-06-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic is similar to SharpHound file modifications, but
+  this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound
+  equivilent but for Azure. It's possible this may never be seen in an environment
+  as most attackers may execute this tool remotely. Once execution is complete, a
+  zip file with a similar name will drop `20210601090751-azurecollection.zip`. In
+  addition to the zip, multiple .json files will be written to disk, which are in
+  the zip.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip",
+  "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json",
+  "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name
+  Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on file modifications that include the name of the process, and file, responsible
+  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
+  node.
+known_false_positives: False positives should be limited as the analytic is specific
+  to a filename with extension .zip. Filter as needed.
+references:
+- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
+- https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1
+tags:
+  analytic_story:
+  - Discovery Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - file_path
+  - dest
+  - file_name
+  - process_id
+  - file_create_time
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -35,6 +35,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
+  - Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_renamed_7_zip.yml

@@ -0,0 +1,49 @@
+name: Detect Renamed 7-Zip
+id: 4057291a-b8cf-11eb-95fe-acde48001122
+version: 1
+date: '2021-05-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
+  this stage of an attack, review parallel processes and file modifications for data
+  that is staged or potentially have been exfiltrated. This analytic utilizes the
+  OriginalFileName to capture the renamed process.
+search: '`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe) |
+  stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
+  process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Limited false positives, however this analytic will need to
+  be modified for each environment if Sysmon is not used.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
+tags:
+  analytic_story:
+  - Collection and Staging
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1560.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_renamed_psexec.yml

@@ -0,0 +1,59 @@
+name: Detect Renamed PSExec
+id: 683e6196-b8e8-11eb-9a79-acde48001122
+version: 1
+date: '2021-05-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies renamed instances of `PsExec.exe` being
+  utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe`
+  or other SysInternal utility usage with the command-line argument of `-accepteula`.
+  In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
+  usage. During triage, validate this is the legitimate version of `PsExec` by review
+  the PE metadata. In addition, review parallel processes for further suspicious behavior.
+search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) |
+  stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
+  process_name, OriginalFileName, process_path, CommandLine Product | rename Computer
+  as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_renamed_psexec_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: Limited false positives should be present. It is possible some
+  third party applications may use older versions of PsExec, filter as needed.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
+- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
+tags:
+  analytic_story:
+  - SamSam Ransomware
+  - DHS Report TA18-074A
+  - HAFNIUM Group
+  - DarkSide Ransomware
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Lateral Movement
+  - Execution
+  mitre_attack_id:
+  - T1569.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_renamed_winrar.yml

@@ -0,0 +1,53 @@
+name: Detect Renamed WinRAR
+id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
+version: 1
+date: '2021-05-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analtyic identifies renamed instances of `WinRAR.exe`.
+  In most cases, it is not common for WinRAR to be used renamed, however it is common
+  to be installed by a third party application and executed from a non-standard path.
+  In this instance, we are using `OriginalFileName` from Sysmon to determine if the
+  process is WinRAR. During triage, validate additional metadata from the binary that
+  this is `WinRAR`. Review parallel processes and file modifications.
+search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_renamed_winrar_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Modify query for specific EDR products as needed.
+known_false_positives: Unknown. It is possible third party applications use renamed
+  instances of WinRAR.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
+tags:
+  analytic_story:
+  - Collection and Staging
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Exfiltration
+  mitre_attack_id:
+  - T1560.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_sharphound_command_line_arguments.yml

@@ -0,0 +1,59 @@
+name: Detect SharpHound Command-Line Arguments
+id: a0bdd2f6-c2ff-11eb-b918-acde48001122
+version: 1
+date: '2021-06-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies common command-line arguments used
+  by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
+  function names may be modified, but these changes are dependent upon the operator.
+  In most instances the defaults are used. This analytic works to identify the common
+  command-line attributes used. It does not cover the entirety of every argument in
+  order to avoid false positives.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited as the arguments used are
+  specific to SharpHound. Filter as needed or add more command-line arguments as needed.
+references:
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+tags:
+  analytic_story:
+  - Discovery Techniques
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_sharphound_file_modifications.yml

@@ -0,0 +1,67 @@
+name: Detect SharpHound File Modifications
+id: 42b4b438-beed-11eb-ba1d-acde48001122
+version: 1
+date: '2021-05-27'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound.
+  SharpHound will query the domain controller and begin gathering all the data related
+  to the domain and trusts. For output, it will drop a .zip file upon completion following
+  a typical pattern that is often not changed. This analytic focuses on the default
+  file name scheme. Note that this may be evaded with different parameters within
+  SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip`
+  are two examples. In addition, executing SharpHound via .exe or .ps1 without any
+  command-line arguments will still perform activity and dump output to the default
+  filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates
+  multiple temp files following the same pattern `20210601182121_computers.json`,
+  `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required,
+  or remove these json's entirely if it is too noisy. During traige, review parallel
+  processes for further suspicious behavior. Typically, the process executing the
+  `.ps1` ingestor will be PowerShell.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip",
+  "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json")
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path
+  Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on file modifications that include the name of the process, and file, responsible
+  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
+  node.
+known_false_positives: False positives should be limited as the analytic is specific
+  to a filename with extension .zip. Filter as needed.
+references:
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+tags:
+  analytic_story:
+  - Discovery Techniques
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - file_path
+  - dest
+  - file_name
+  - process_id
+  - file_create_time
+  security_domain: endpoint
+  automated_detection_testing: passed

detections/endpoint/detect_sharphound_usage.yml

@@ -0,0 +1,63 @@
+name: Detect SharpHound Usage
+id: dd04b29a-beed-11eb-87bc-acde48001122
+version: 1
+date: '2021-05-27'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies SharpHound binary usage by using the
+  `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is
+  available to detect command-line arguments. This particular analytic only looks
+  for the OriginalFileName of `SharpHound.exe`. It is possible older instances of
+  SharpHound.exe have different original filenames. Dependent upon the operator, the
+  code may be re-compiled and the attributes removed or changed to anything else.
+  During triage, review the metadata of the binary in question. Review parallel processes
+  for suspicious behavior. Identify the source of this binary.
+search: '`sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_sharphound_usage_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited as this is specific to a
+  file attribute not used by anything else. Filter as needed.
+references:
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+tags:
+  analytic_story:
+  - Discovery Techniques
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
+  automated_detection_testing: passed

stories/windows_discovery_techniques.yml

@@ -15,6 +15,7 @@ narrative: Attackers may not have much if any insight into their target's enviro
 references:
   - https://attack.mitre.org/tactics/TA0007/
   - https://cyberd.us/penetration-testing
+  - https://attack.mitre.org/software/S0521/
 tags:
   analytic_story:
     - Windows Discovery Techniques
@@ -22,4 +23,7 @@ tags:
     - Adversary Tactics
   product:
     - Splunk Behavioral Analytics
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
   usecase: Advanced Threat Detection

tests/endpoint/cmd_echo_pipe___escalation.test.yml

@@ -0,0 +1,12 @@
+name: CMD Echo Pipe - Escalation Unit Test
+tests:
+- name: CMD Echo Pipe - Escalation
+  file: endpoint/cmd_echo_pipe___escalation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_azurehound_command_line_arguments.test.yml

@@ -0,0 +1,12 @@
+name: Detect AzureHound Command-Line Arguments Unit Test
+tests:
+- name: Detect AzureHound Command-Line Arguments
+  file: endpoint/detect_azurehound_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_azurehound_file_modifications.test.yml

@@ -0,0 +1,12 @@
+name: Detect AzureHound File Modifications Unit Test
+tests:
+- name: Detect AzureHound File Modifications
+  file: endpoint/detect_azurehound_file_modifications.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_renamed_7_zip.test.yml

@@ -0,0 +1,12 @@
+name: Detect Renamed 7-Zip Unit Test
+tests:
+- name: Detect Renamed 7-Zip
+  file: endpoint/detect_renamed_7_zip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_renamed_psexec.test.yml

@@ -0,0 +1,12 @@
+name: Detect Renamed PSExec Unit Test
+tests:
+- name: Detect Renamed PSExec
+  file: endpoint/detect_renamed_psexec.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_renamed_winrar.test.yml

@@ -0,0 +1,12 @@
+name: Detect Renamed WinRAR Unit Test
+tests:
+- name: Detect Renamed WinRAR
+  file: endpoint/detect_renamed_winrar.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_sharphound_command_line_arguments.test.yml

@@ -0,0 +1,12 @@
+name: Detect SharpHound Command-Line Arguments Unit Test
+tests:
+- name: Detect SharpHound Command-Line Arguments
+  file: endpoint/detect_sharphound_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_sharphound_file_modifications.test.yml

@@ -0,0 +1,12 @@
+name: Detect SharpHound File Modifications Unit Test
+tests:
+- name: Detect SharpHound File Modifications
+  file: endpoint/detect_sharphound_file_modifications.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/detect_sharphound_usage.test.yml

@@ -0,0 +1,12 @@
+name: Detect SharpHound Usage Unit Test
+tests:
+- name: Detect SharpHound Usage
+  file: endpoint/detect_sharphound_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog