Merge branch 'AD_Discovery_TR-789_6' of github.com:splunk/security_content into AD_Discovery_TR-789_6

detections/endpoint/getdomaingroup_with_powershell_script_block.yml

@@ -7,16 +7,19 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
-  As the name suggests, `Get-DomainGroup` is used to query domain groups.
-  Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
+  to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup`
+  is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
+  As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams
+  and adversaries may leverage this function to enumerate domain groups for situational
+  awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+  User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators or power users may use this PowerView functions for troubleshooting.
+known_false_positives: Administrators or power users may use this PowerView functions
+  for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/
@@ -52,4 +55,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/getwmiobject_ds_group_with_powershell.yml

@@ -7,14 +7,18 @@ type: TTP
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
-  arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain.
-  Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery.
+  arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined
+  with the `-class ds_group` parameter can be used to return the full list of groups
+  in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case,
+  using PowerShell, to enumerate domain groups for situational awareness and Active
+  Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") 
-  (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" AND Processes.process="*class ds_group*")
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
+  (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*"
+  AND Processes.process="*class ds_group*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `getwmiobject_ds_group_with_powershell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -22,7 +26,6 @@ known_false_positives: Administrators or power users may use this command for tr
 references:
 - https://attack.mitre.org/techniques/T1069/002/
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
-
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -61,4 +64,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml

@@ -7,18 +7,22 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. 
-  Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`'
+  to identify the execution of the `Get-WmiObject` commandlet used with specific parameters
+  . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
+  and adversaries may leverage this commandlet to enumerate domain groups for situational
+  awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
+  root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `getwmiobject_ds_group_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
-- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -51,4 +55,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed