From 95c1b4408caa591aeb363560c5fe617cbebba5ad Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 27 May 2021 08:22:53 -0600
Subject: [PATCH 01/15] Cobalt Jump

---
 .../endpoint/cmd_echo_pipe___escalation.yml   | 48 +++++++++++++++++++
 .../cmd_echo_pipe___escalation.test.yml       | 12 +++++
 2 files changed, 60 insertions(+)
 create mode 100644 detections/endpoint/cmd_echo_pipe___escalation.yml
 create mode 100644 tests/endpoint/cmd_echo_pipe___escalation.test.yml

diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml
new file mode 100644
index 0000000000..4e99e83cc6
--- /dev/null
+++ b/detections/endpoint/cmd_echo_pipe___escalation.yml
@@ -0,0 +1,48 @@
+name: CMD Echo Pipe - Escalation
+id: eb277ba0-b96b-11eb-b00e-acde48001122
+version: 1
+date: '2021-05-20'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe OR Processes.process=*%comspec%*)
+  (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `cmd_echo_pipe___escalation_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Unknown. It is possible filtering may be required to ensure fidelity. 
+references:
+  - https://redcanary.com/threat-detection-report/threats/cobalt-strike/
+  - https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
+tags:
+  analytic_story:
+  - Cobalt Strike
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1059.003
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/cmd_echo_pipe___escalation.test.yml b/tests/endpoint/cmd_echo_pipe___escalation.test.yml
new file mode 100644
index 0000000000..7cb42e8713
--- /dev/null
+++ b/tests/endpoint/cmd_echo_pipe___escalation.test.yml
@@ -0,0 +1,12 @@
+name: CMD Echo Pipe - Escalation Unit Test
+tests:
+- name: CMD Echo Pipe - Escalation
+  file: endpoint/cmd_echo_pipe___escalation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From b7e82d565db6101961a1b5b5c22431aa1de0202f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-206-47>
Date: Thu, 27 May 2021 14:55:40 +0000
Subject: [PATCH 02/15] Added detection testing service results inCMD Echo Pipe
 - Escalation

---
 .../endpoint/cmd_echo_pipe___escalation.yml   | 30 +++++++++++--------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml
index 4e99e83cc6..7f23ef53de 100644
--- a/detections/endpoint/cmd_echo_pipe___escalation.yml
+++ b/detections/endpoint/cmd_echo_pipe___escalation.yml
@@ -6,26 +6,29 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. 
+description: This analytic identifies a common behavior by Cobalt Strike and other
+  frameworks where the adversary will escalate privileges, either via `jump` (Cobalt
+  Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will
+  look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe OR Processes.process=*%comspec%*)
-  (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `cmd_echo_pipe___escalation_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe
+  OR Processes.process=*%comspec%*) (Processes.process=*echo* AND Processes.process=*pipe*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Unknown. It is possible filtering may be required to ensure fidelity. 
+known_false_positives: Unknown. It is possible filtering may be required to ensure
+  fidelity.
 references:
-  - https://redcanary.com/threat-detection-report/threats/cobalt-strike/
-  - https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
+- https://redcanary.com/threat-detection-report/threats/cobalt-strike/
+- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
 tags:
   analytic_story:
   - Cobalt Strike
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   - Privilege Escalation
@@ -45,4 +48,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From cc40bf658c430b136f47d7d0e8f64230008211e9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Jun 2021 08:48:19 -0600
Subject: [PATCH 03/15] SharpHound

---
 .../detect_azurehound_file_modifications.yml  | 47 ++++++++++++++++
 ...tect_sharphound_command_line_arguments.yml | 52 ++++++++++++++++++
 .../detect_sharphound_file_modifications.yml  | 54 +++++++++++++++++++
 .../endpoint/detect_sharphound_usage.yml      | 53 ++++++++++++++++++
 stories/windows_discovery_techniques.yml      |  4 ++
 ...ect_azurehound_file_modifications.test.yml | 12 +++++
 ...sharphound_command_line_arguments.test.yml | 12 +++++
 ...ect_sharphound_file_modifications.test.yml | 12 +++++
 .../endpoint/detect_sharphound_usage.test.yml | 12 +++++
 9 files changed, 258 insertions(+)
 create mode 100644 detections/endpoint/detect_azurehound_file_modifications.yml
 create mode 100644 detections/endpoint/detect_sharphound_command_line_arguments.yml
 create mode 100644 detections/endpoint/detect_sharphound_file_modifications.yml
 create mode 100644 detections/endpoint/detect_sharphound_usage.yml
 create mode 100644 tests/endpoint/detect_azurehound_file_modifications.test.yml
 create mode 100644 tests/endpoint/detect_sharphound_command_line_arguments.test.yml
 create mode 100644 tests/endpoint/detect_sharphound_file_modifications.test.yml
 create mode 100644 tests/endpoint/detect_sharphound_usage.test.yml

diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml
new file mode 100644
index 0000000000..50b02b1dbb
--- /dev/null
+++ b/detections/endpoint/detect_azurehound_file_modifications.yml
@@ -0,0 +1,47 @@
+name: Detect AzureHound File Modifications
+id: 1c34549e-c31b-11eb-996b-acde48001122
+version: 1
+date: '2021-06-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json")
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest 
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_azurehound_file_modifications_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on file modifications that include the name of the process, and file, responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
+references:
+  - https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
+  - https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1
+tags:
+  analytic_story:
+  - Discovery Techniques
+  dataset: []
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - file_path
+  - dest
+  - file_name
+  - process_id
+  - file_create_time
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
new file mode 100644
index 0000000000..3c5cf2cdf6
--- /dev/null
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -0,0 +1,52 @@
+name: Detect SharpHound Command-Line Arguments
+id: a0bdd2f6-c2ff-11eb-b918-acde48001122
+version: 1
+date: '2021-06-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `detect_sharphound_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
+references:
+  - https://attack.mitre.org/software/S0521/
+  - https://thedfirreport.com/?s=bloodhound
+  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+  - https://github.com/BloodHoundAD/SharpHound3
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+tags:
+  analytic_story:
+  - Discovery Techniques
+  dataset: []
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml
new file mode 100644
index 0000000000..a8311eb140
--- /dev/null
+++ b/detections/endpoint/detect_sharphound_file_modifications.yml
@@ -0,0 +1,54 @@
+name: Detect SharpHound File Modifications
+id: 42b4b438-beed-11eb-ba1d-acde48001122
+version: 1
+date: '2021-05-27'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed.
+  This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename.
+  Example default filename `20210601181553_BloodHound.zip`.
+  SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy.
+  During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json")
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest 
+  | `drop_dm_object_name(Filesystem)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_sharphound_file_modifications_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on file modifications that include the name of the process, and file, responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0521/
+  - https://thedfirreport.com/?s=bloodhound
+  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+  - https://github.com/BloodHoundAD/SharpHound3
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+tags:
+  analytic_story:
+  - Discovery Techniques
+  dataset: []
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - file_path
+  - dest
+  - file_name
+  - process_id
+  - file_create_time
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
new file mode 100644
index 0000000000..1abc3bcde9
--- /dev/null
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -0,0 +1,53 @@
+name: Detect SharpHound Usage
+id: dd04b29a-beed-11eb-87bc-acde48001122
+version: 1
+date: '2021-05-27'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. 
+  During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary.
+search: '`sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0521/
+  - https://thedfirreport.com/?s=bloodhound
+  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+  - https://github.com/BloodHoundAD/SharpHound3
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+tags:
+  analytic_story:
+  - Discovery Techniques
+  dataset: []
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
\ No newline at end of file
diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml
index 29a7004cf0..5b0a190e53 100644
--- a/stories/windows_discovery_techniques.yml
+++ b/stories/windows_discovery_techniques.yml
@@ -15,6 +15,7 @@ narrative: Attackers may not have much if any insight into their target's enviro
 references:
   - https://attack.mitre.org/tactics/TA0007/
   - https://cyberd.us/penetration-testing
+  - https://attack.mitre.org/software/S0521/
 tags:
   analytic_story:
     - Windows Discovery Techniques
@@ -22,4 +23,7 @@ tags:
     - Adversary Tactics
   product:
     - Splunk Behavioral Analytics
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
   usecase: Advanced Threat Detection
diff --git a/tests/endpoint/detect_azurehound_file_modifications.test.yml b/tests/endpoint/detect_azurehound_file_modifications.test.yml
new file mode 100644
index 0000000000..3db5f91274
--- /dev/null
+++ b/tests/endpoint/detect_azurehound_file_modifications.test.yml
@@ -0,0 +1,12 @@
+name: Detect AzureHound File Modifications Unit Test
+tests:
+- name: Detect AzureHound File Modifications
+  file: endpoint/detect_azurehound_file_modifications.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/detect_sharphound_command_line_arguments.test.yml b/tests/endpoint/detect_sharphound_command_line_arguments.test.yml
new file mode 100644
index 0000000000..837aca3e30
--- /dev/null
+++ b/tests/endpoint/detect_sharphound_command_line_arguments.test.yml
@@ -0,0 +1,12 @@
+name: Detect SharpHound Command-Line Arguments Unit Test
+tests:
+- name: Detect SharpHound Command-Line Arguments
+  file: endpoint/detect_sharphound_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/detect_sharphound_file_modifications.test.yml b/tests/endpoint/detect_sharphound_file_modifications.test.yml
new file mode 100644
index 0000000000..29fc4d865b
--- /dev/null
+++ b/tests/endpoint/detect_sharphound_file_modifications.test.yml
@@ -0,0 +1,12 @@
+name: Detect SharpHound File Modifications Unit Test
+tests:
+- name: Detect SharpHound File Modifications
+  file: endpoint/detect_sharphound_file_modifications.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/detect_sharphound_usage.test.yml b/tests/endpoint/detect_sharphound_usage.test.yml
new file mode 100644
index 0000000000..da4408fc50
--- /dev/null
+++ b/tests/endpoint/detect_sharphound_usage.test.yml
@@ -0,0 +1,12 @@
+name: Detect SharpHound Usage Unit Test
+tests:
+- name: Detect SharpHound Usage
+  file: endpoint/detect_sharphound_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 487c1c861ee50512a93d900d314e38bc2f510602 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Jun 2021 09:17:31 -0600
Subject: [PATCH 04/15] psexec renamed

---
 detections/endpoint/detect_renamed_psexec.yml | 52 +++++++++++++++++++
 tests/endpoint/detect_renamed_psexec.test.yml | 12 +++++
 2 files changed, 64 insertions(+)
 create mode 100644 detections/endpoint/detect_renamed_psexec.yml
 create mode 100644 tests/endpoint/detect_renamed_psexec.test.yml

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
new file mode 100644
index 0000000000..ba4aeb92b6
--- /dev/null
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -0,0 +1,52 @@
+name: Detect Renamed PSExec
+id: 683e6196-b8e8-11eb-9a79-acde48001122
+version: 1
+date: '2021-05-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage.
+  During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior.
+search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `detect_renamed_psexec_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
+  - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
+tags:
+  analytic_story:
+  - SamSam Ransomware
+  - DHS Report TA18-074A
+  - HAFNIUM Group
+  - DarkSide Ransomware
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  - Lateral Movement
+  - Execution
+  mitre_attack_id:
+  - T1569.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/detect_renamed_psexec.test.yml b/tests/endpoint/detect_renamed_psexec.test.yml
new file mode 100644
index 0000000000..4433a31734
--- /dev/null
+++ b/tests/endpoint/detect_renamed_psexec.test.yml
@@ -0,0 +1,12 @@
+name: Detect Renamed PSExec Unit Test
+tests:
+- name: Detect Renamed PSExec
+  file: endpoint/detect_renamed_psexec.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 316d57e15695e5a15ecec507600168287f13a4ea Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-83-220>
Date: Thu, 3 Jun 2021 15:22:51 +0000
Subject: [PATCH 05/15] Added detection testing service results inDetect
 AzureHound File Modifications

---
 .../detect_azurehound_file_modifications.yml  | 37 ++++++++++++-------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml
index 50b02b1dbb..29457b304e 100644
--- a/detections/endpoint/detect_azurehound_file_modifications.yml
+++ b/detections/endpoint/detect_azurehound_file_modifications.yml
@@ -6,25 +6,33 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip.
+description: The following analytic is similar to SharpHound file modifications, but
+  this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound
+  equivilent but for Azure. It's possible this may never be seen in an environment
+  as most attackers may execute this tool remotely. Once execution is complete, a
+  zip file with a similar name will drop `20210601090751-azurecollection.zip`. In
+  addition to the zip, multiple .json files will be written to disk, which are in
+  the zip.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json")
-  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest 
-  | `drop_dm_object_name(Filesystem)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_azurehound_file_modifications_filter`'
+  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip",
+  "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json",
+  "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name
+  Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
-  on file modifications that include the name of the process, and file, responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
+  on file modifications that include the name of the process, and file, responsible
+  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
+  node.
+known_false_positives: False positives should be limited as the analytic is specific
+  to a filename with extension .zip. Filter as needed.
 references:
-  - https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
-  - https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1
+- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
+- https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1
 tags:
   analytic_story:
   - Discovery Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -44,4 +52,5 @@ tags:
   - file_name
   - process_id
   - file_create_time
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 5b00a4c89d372debfd73dd4e6977fdf08b39737a Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-48-173>
Date: Thu, 3 Jun 2021 15:24:00 +0000
Subject: [PATCH 06/15] Added detection testing service results inDetect
 SharpHound File Modifications

---
 .../detect_sharphound_file_modifications.yml  | 54 +++++++++++--------
 1 file changed, 33 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml
index a8311eb140..f8595c2a4d 100644
--- a/detections/endpoint/detect_sharphound_file_modifications.yml
+++ b/detections/endpoint/detect_sharphound_file_modifications.yml
@@ -6,32 +6,43 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed.
-  This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename.
-  Example default filename `20210601181553_BloodHound.zip`.
-  SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy.
-  During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell.
+description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound.
+  SharpHound will query the domain controller and begin gathering all the data related
+  to the domain and trusts. For output, it will drop a .zip file upon completion following
+  a typical pattern that is often not changed. This analytic focuses on the default
+  file name scheme. Note that this may be evaded with different parameters within
+  SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip`
+  are two examples. In addition, executing SharpHound via .exe or .ps1 without any
+  command-line arguments will still perform activity and dump output to the default
+  filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates
+  multiple temp files following the same pattern `20210601182121_computers.json`,
+  `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required,
+  or remove these json's entirely if it is too noisy. During traige, review parallel
+  processes for further suspicious behavior. Typically, the process executing the
+  `.ps1` ingestor will be PowerShell.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json")
-  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest 
-  | `drop_dm_object_name(Filesystem)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_sharphound_file_modifications_filter`'
+  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip",
+  "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json")
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path
+  Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
-  on file modifications that include the name of the process, and file, responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
+  on file modifications that include the name of the process, and file, responsible
+  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
+  node.
+known_false_positives: False positives should be limited as the analytic is specific
+  to a filename with extension .zip. Filter as needed.
 references:
-  - https://attack.mitre.org/software/S0521/
-  - https://thedfirreport.com/?s=bloodhound
-  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-  - https://github.com/BloodHoundAD/SharpHound3
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
 tags:
   analytic_story:
   - Discovery Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -51,4 +62,5 @@ tags:
   - file_name
   - process_id
   - file_create_time
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 07a5c51b3b4b38ba6525ab56cf2d749fb7ccbe07 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-19-83>
Date: Thu, 3 Jun 2021 15:25:21 +0000
Subject: [PATCH 07/15] Added detection testing service results inDetect
 SharpHound Usage

---
 .../endpoint/detect_sharphound_usage.yml      | 37 ++++++++++++-------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index 1abc3bcde9..815ba5b41c 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -6,28 +6,36 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies SharpHound binary usage by using the `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic only looks for the OriginalFileName of `SharpHound.exe`. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. 
-  During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary.
+description: The following analytic identifies SharpHound binary usage by using the
+  `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is
+  available to detect command-line arguments. This particular analytic only looks
+  for the OriginalFileName of `SharpHound.exe`. It is possible older instances of
+  SharpHound.exe have different original filenames. Dependent upon the operator, the
+  code may be re-compiled and the attributes removed or changed to anything else.
+  During triage, review the metadata of the binary in question. Review parallel processes
+  for suspicious behavior. Identify the source of this binary.
 search: '`sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
-  | rename Computer as dest 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`'
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_sharphound_usage_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed.
+known_false_positives: False positives should be limited as this is specific to a
+  file attribute not used by anything else. Filter as needed.
 references:
-  - https://attack.mitre.org/software/S0521/
-  - https://thedfirreport.com/?s=bloodhound
-  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-  - https://github.com/BloodHoundAD/SharpHound3
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
 tags:
   analytic_story:
   - Discovery Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -50,4 +58,5 @@ tags:
   - process_path
   - CommandLine
   - Product
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 88a3daef8b7dad79364aa4a2816efceeb67f13e4 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-19-83>
Date: Thu, 3 Jun 2021 15:25:32 +0000
Subject: [PATCH 08/15] Added detection testing service results inDetect
 SharpHound Command-Line Arguments

---
 ...tect_sharphound_command_line_arguments.yml | 36 +++++++++++--------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
index 3c5cf2cdf6..a8af92e86d 100644
--- a/detections/endpoint/detect_sharphound_command_line_arguments.yml
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -6,28 +6,33 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives.
+description: The following analytic identifies common command-line arguments used
+  by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
+  function names may be modified, but these changes are dependent upon the operator.
+  In most instances the defaults are used. This analytic works to identify the common
+  command-line attributes used. It does not cover the entirety of every argument in
+  order to avoid false positives.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `detect_sharphound_command_line_arguments_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
+known_false_positives: False positives should be limited as the arguments used are
+  specific to SharpHound. Filter as needed or add more command-line arguments as needed.
 references:
-  - https://attack.mitre.org/software/S0521/
-  - https://thedfirreport.com/?s=bloodhound
-  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-  - https://github.com/BloodHoundAD/SharpHound3
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
 tags:
   analytic_story:
   - Discovery Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -49,4 +54,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From f269268b5af2be9b24536e9937d7915c213990f0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Jun 2021 09:41:39 -0600
Subject: [PATCH 09/15] 7zip and rar

---
 detections/endpoint/detect_renamed_7_zip.yml  | 46 ++++++++++++++++++
 detections/endpoint/detect_renamed_winrar.yml | 48 +++++++++++++++++++
 tests/endpoint/detect_renamed_7_zip.test.yml  | 12 +++++
 tests/endpoint/detect_renamed_winrar.test.yml | 12 +++++
 4 files changed, 118 insertions(+)
 create mode 100644 detections/endpoint/detect_renamed_7_zip.yml
 create mode 100644 detections/endpoint/detect_renamed_winrar.yml
 create mode 100644 tests/endpoint/detect_renamed_7_zip.test.yml
 create mode 100644 tests/endpoint/detect_renamed_winrar.test.yml

diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
new file mode 100644
index 0000000000..1bb25a9f9f
--- /dev/null
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -0,0 +1,46 @@
+name: Detect Renamed 7-Zip
+id: 4057291a-b8cf-11eb-95fe-acde48001122
+version: 1
+date: '2021-05-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process.
+search: '`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `detect_renamed_7_zip_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md 
+tags:
+  analytic_story:
+  - Collection and Staging
+  dataset: []
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1560.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
new file mode 100644
index 0000000000..83112a3438
--- /dev/null
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -0,0 +1,48 @@
+name: Detect Renamed WinRAR
+id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
+version: 1
+date: '2021-05-19'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. 
+  During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. 
+search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `detect_renamed_winrar_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Modify query for specific EDR products as needed.
+known_false_positives: Unknown. It is possible third party applications use renamed instances of WinRAR.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
+tags:
+  analytic_story:
+  - Collection and Staging
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  - Exfiltration
+  mitre_attack_id:
+  - T1560.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - User
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
+  - CommandLine
+  - Product
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/detect_renamed_7_zip.test.yml b/tests/endpoint/detect_renamed_7_zip.test.yml
new file mode 100644
index 0000000000..e0d0b5016b
--- /dev/null
+++ b/tests/endpoint/detect_renamed_7_zip.test.yml
@@ -0,0 +1,12 @@
+name: Detect Renamed 7-Zip Unit Test
+tests:
+- name: Detect Renamed 7-Zip
+  file: endpoint/detect_renamed_7_zip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/detect_renamed_winrar.test.yml b/tests/endpoint/detect_renamed_winrar.test.yml
new file mode 100644
index 0000000000..62ae0f0c3d
--- /dev/null
+++ b/tests/endpoint/detect_renamed_winrar.test.yml
@@ -0,0 +1,12 @@
+name: Detect Renamed WinRAR Unit Test
+tests:
+- name: Detect Renamed WinRAR
+  file: endpoint/detect_renamed_winrar.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 70bb5ebcde59d6a27a27b87c55303da8b78e160e Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-95-108>
Date: Thu, 3 Jun 2021 16:03:05 +0000
Subject: [PATCH 10/15] Added detection testing service results inDetect
 Renamed PSExec

---
 detections/endpoint/detect_renamed_psexec.yml | 30 +++++++++++--------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index ba4aeb92b6..41bbe076ed 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -6,29 +6,34 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` usage.
-  During triage, validate this is the legitimate version of `PsExec` by review the PE metadata. In addition, review parallel processes for further suspicious behavior.
-search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
-  | rename Computer as dest 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: The following analytic identifies renamed instances of `PsExec.exe` being
+  utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe`
+  or other SysInternal utility usage with the command-line argument of `-accepteula`.
+  In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
+  usage. During triage, validate this is the legitimate version of `PsExec` by review
+  the PE metadata. In addition, review parallel processes for further suspicious behavior.
+search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) |
+  stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
+  process_name, OriginalFileName, process_path, CommandLine Product | rename Computer
+  as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed.
+known_false_positives: Limited false positives should be present. It is possible some
+  third party applications may use older versions of PsExec, filter as needed.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
-  - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
+- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
 tags:
   analytic_story:
   - SamSam Ransomware
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   - Lateral Movement
@@ -49,4 +54,5 @@ tags:
   - process_path
   - CommandLine
   - Product
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 12caaec7ed5b4a4db03b2177a63fb4a6c0af4ccc Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-178-91>
Date: Thu, 3 Jun 2021 16:06:24 +0000
Subject: [PATCH 11/15] Added detection testing service results inDetect
 Renamed 7-Zip

---
 detections/endpoint/detect_renamed_7_zip.yml | 29 +++++++++++---------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index 1bb25a9f9f..e48b741092 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -6,25 +6,27 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process.
-search: '`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe)
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine 
-  | rename Computer as dest 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `detect_renamed_7_zip_filter`'
+description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
+  this stage of an attack, review parallel processes and file modifications for data
+  that is staged or potentially have been exfiltrated. This analytic utilizes the
+  OriginalFileName to capture the renamed process.
+search: '`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe) |
+  stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
+  process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used.
+  Sysmon TA.
+known_false_positives: Limited false positives, however this analytic will need to
+  be modified for each environment if Sysmon is not used.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md 
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 tags:
   analytic_story:
   - Collection and Staging
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
   kill_chain_phases:
   - Exfiltration
   mitre_attack_id:
@@ -43,4 +45,5 @@ tags:
   - process_path
   - CommandLine
   - Product
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 17a7c53100889bff26f08164c6f26cbd347adbbe Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-178-91>
Date: Thu, 3 Jun 2021 16:07:16 +0000
Subject: [PATCH 12/15] Added detection testing service results inDetect
 Renamed WinRAR

---
 detections/endpoint/detect_renamed_winrar.yml | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 83112a3438..36e298b533 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -6,26 +6,30 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. In this instance, we are using `OriginalFileName` from Sysmon to determine if the process is WinRAR. 
-  During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. 
+description: The following analtyic identifies renamed instances of `WinRAR.exe`.
+  In most cases, it is not common for WinRAR to be used renamed, however it is common
+  to be installed by a third party application and executed from a non-standard path.
+  In this instance, we are using `OriginalFileName` from Sysmon to determine if the
+  process is WinRAR. During triage, validate additional metadata from the binary that
+  this is `WinRAR`. Review parallel processes and file modifications.
 search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
   parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
-  | rename Computer as dest 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_winrar_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Modify query for specific EDR products as needed.
-known_false_positives: Unknown. It is possible third party applications use renamed instances of WinRAR.
+known_false_positives: Unknown. It is possible third party applications use renamed
+  instances of WinRAR.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 tags:
   analytic_story:
   - Collection and Staging
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   - Exfiltration
@@ -45,4 +49,5 @@ tags:
   - process_path
   - CommandLine
   - Product
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From 2af2dbdd0e203d677025d34322a6a1c0120aaab7 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Jun 2021 10:40:41 -0600
Subject: [PATCH 13/15] AzureHound

---
 ...tect_azurehound_command_line_arguments.yml | 56 +++++++++++++++++++
 ...azurehound_command_line_arguments.test.yml | 12 ++++
 2 files changed, 68 insertions(+)
 create mode 100644 detections/endpoint/detect_azurehound_command_line_arguments.yml
 create mode 100644 tests/endpoint/detect_azurehound_command_line_arguments.test.yml

diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml
new file mode 100644
index 0000000000..3da4cb1f72
--- /dev/null
+++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml
@@ -0,0 +1,56 @@
+name: Detect AzureHound Command-Line Arguments
+id: 26f02e96-c300-11eb-b611-acde48001122
+version: 1
+date: '2021-06-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the common command-line argument used
+  by AzureHound `Invoke-AzureHound`. Being the script is FOSS,
+  function names may be modified, but these changes are dependent upon the operator.
+  In most instances the defaults are used. This analytic works to identify the common
+  command-line attributes used. It does not cover the entirety of every argument in
+  order to avoid false positives. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`  
+  | `detect_azurehound_command_line_arguments_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Unknown.
+references:
+  - https://attack.mitre.org/software/S0521/
+  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+  - https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
+  - https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1
+tags:
+  analytic_story:
+  - Discovery Techniques
+  dataset: []
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.002
+  - T1087.001
+  - T1482
+  - T1069.002
+  - T1069.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/detect_azurehound_command_line_arguments.test.yml b/tests/endpoint/detect_azurehound_command_line_arguments.test.yml
new file mode 100644
index 0000000000..67a0591dcd
--- /dev/null
+++ b/tests/endpoint/detect_azurehound_command_line_arguments.test.yml
@@ -0,0 +1,12 @@
+name: Detect AzureHound Command-Line Arguments Unit Test
+tests:
+- name: Detect AzureHound Command-Line Arguments
+  file: endpoint/detect_azurehound_command_line_arguments.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 31738b185583f2eb24f271f92c39a272b1ff9cb1 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-2-3>
Date: Thu, 3 Jun 2021 17:01:51 +0000
Subject: [PATCH 14/15] Added detection testing service results inDetect
 AzureHound Command-Line Arguments

---
 ...tect_azurehound_command_line_arguments.yml | 33 +++++++++----------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml
index 3da4cb1f72..60d457ee0e 100644
--- a/detections/endpoint/detect_azurehound_command_line_arguments.yml
+++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml
@@ -7,31 +7,29 @@ type: batch
 datamodel:
 - Endpoint
 description: The following analytic identifies the common command-line argument used
-  by AzureHound `Invoke-AzureHound`. Being the script is FOSS,
-  function names may be modified, but these changes are dependent upon the operator.
-  In most instances the defaults are used. This analytic works to identify the common
-  command-line attributes used. It does not cover the entirety of every argument in
-  order to avoid false positives. 
+  by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may
+  be modified, but these changes are dependent upon the operator. In most instances
+  the defaults are used. This analytic works to identify the common command-line attributes
+  used. It does not cover the entirety of every argument in order to avoid false positives.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`  
-  | `detect_azurehound_command_line_arguments_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: Unknown.
 references:
-  - https://attack.mitre.org/software/S0521/
-  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-  - https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
-  - https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1
+- https://attack.mitre.org/software/S0521/
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
+- https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1
 tags:
   analytic_story:
   - Discovery Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -53,4 +51,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed

From facc82325551ef44ce98dfbdfbde2c1e035cb3db Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Jun 2021 14:20:59 -0600
Subject: [PATCH 15/15] Updated Analytic Stories

---
 detections/endpoint/detect_psexec_with_accepteula_flag.yml       | 1 +
 detections/endpoint/detect_renamed_psexec.yml                    | 1 +
 detections/endpoint/detect_sharphound_command_line_arguments.yml | 1 +
 detections/endpoint/detect_sharphound_file_modifications.yml     | 1 +
 detections/endpoint/detect_sharphound_usage.yml                  | 1 +
 5 files changed, 5 insertions(+)

diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index d257cbbeff..4853444bb1 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -35,6 +35,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
+  - Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 41bbe076ed..c680170fbe 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -32,6 +32,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
+  - Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
index a8af92e86d..40a71caa63 100644
--- a/detections/endpoint/detect_sharphound_command_line_arguments.yml
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -31,6 +31,7 @@ references:
 tags:
   analytic_story:
   - Discovery Techniques
+  - Ransomware
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml
index f8595c2a4d..cd97b9e36d 100644
--- a/detections/endpoint/detect_sharphound_file_modifications.yml
+++ b/detections/endpoint/detect_sharphound_file_modifications.yml
@@ -41,6 +41,7 @@ references:
 tags:
   analytic_story:
   - Discovery Techniques
+  - Ransomware
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index 815ba5b41c..5cac410070 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Discovery Techniques
+  - Ransomware
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases: