From 1d44035fc8309e1db49e21d072b0111a7cd1c72f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 8 Sep 2021 23:20:06 +0000
Subject: [PATCH 01/15] Bump pre-commit from 2.14.1 to 2.15.0

Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 2.14.1 to 2.15.0.
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/master/CHANGELOG.md)
- [Commits](https://github.com/pre-commit/pre-commit/compare/v2.14.1...v2.15.0)

---
updated-dependencies:
- dependency-name: pre-commit
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 automated_detection_testing/requirements.txt | 4 ++--
 requirements.txt                             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 204eeb14aa..31c52f36f2 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -6,7 +6,7 @@ atomicwrites==1.4.0
 attackcti==0.3.4.3
 attrs==21.2.0
 azure-common==1.1.27
-azure-core==1.16.0
+azure-core==1.18.0
 azure-identity==1.6.0
 azure-mgmt-compute==20.0.0
 azure-mgmt-core==1.2.1
@@ -45,7 +45,7 @@ path==15.1.2
 path.py==12.5.0
 pexpect==4.8.0
 pluggy==0.13.1
-pre-commit==2.13.0
+pre-commit==2.15.0
 protobuf==3.17.0
 psutil==5.8.0
 ptyprocess==0.7.0
diff --git a/requirements.txt b/requirements.txt
index 68db1ba7c2..ab1210e9ad 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -38,7 +38,7 @@ pendulum==2.1.2
 pep517==0.11.0
 Pillow==8.3.2
 platformdirs==2.3.0
-pre-commit==2.14.1
+pre-commit==2.15.0
 progress==1.6
 prompt-toolkit==1.0.14
 pyfiglet==0.8.post1

From 31c865bcd4ef5523f074462d3bcf0fd2307c0d6d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 8 Sep 2021 23:20:16 +0000
Subject: [PATCH 02/15] Bump boto3 from 1.17.104 to 1.18.38

Bumps [boto3](https://github.com/boto/boto3) from 1.17.104 to 1.18.38.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/boto3/compare/1.17.104...1.18.38)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 automated_detection_testing/requirements.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 204eeb14aa..45b0f55706 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -6,14 +6,14 @@ atomicwrites==1.4.0
 attackcti==0.3.4.3
 attrs==21.2.0
 azure-common==1.1.27
-azure-core==1.16.0
+azure-core==1.18.0
 azure-identity==1.6.0
 azure-mgmt-compute==20.0.0
 azure-mgmt-core==1.2.1
 azure-mgmt-network==19.0.0
 azure-mgmt-resource==17.0.0
 bcrypt==3.2.0
-boto3==1.17.104
+boto3==1.18.38
 botocore==1.20.105
 certifi==2021.5.30
 cffi==1.14.5

From 8ad775773951a13bf08e5a51ba02681ca6b703ce Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 22 Sep 2021 14:45:46 -0600
Subject: [PATCH 03/15] Update
 malicious_powershell_process___encoded_command.yml

---
 ...s_powershell_process___encoded_command.yml | 37 ++++++++++---------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 911a8c929f..e5242cc6de 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -1,27 +1,30 @@
 name: Malicious PowerShell Process - Encoded Command
 id: c4db14d9-7909-48b4-a054-aa14d89dbb19
-version: 4
-date: '2020-07-21'
-author: David Dorsey, Splunk
+version: 5
+date: '2021-09-22'
+author: David Dorsey, Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This search looks for PowerShell processes that have encoded the script
-  within the command-line. Malware has been seen using this parameter, as it obfuscates
-  the code and makes it relatively easy to pass a script on the command-line.
+description: The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. 
+  The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
+  During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = powershell.exe
-  (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user
-  Processes.process_name Processes.process Processes.parent_process_name Processes.dest
-  Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
+  by Processes.user
+  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id 
+  | regex Processes.process="[\-|\/|–|—|―][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\s+[A-Za-z0-9+/=]{5,}" 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `malicious_powershell_process___encoded_command_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: System administrators may use this option, but it's not common.
-references: []
+references:
+  - https://regexr.com/662ov
+  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
+  - https://ss64.com/ps/powershell.html
+  - https://twitter.com/M_haggis/status/1440758396534214658?s=20
 tags:
   analytic_story:
   - Malicious PowerShell

From 1a0e926e7d03103f7f1930f57d0adb52068c94c8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Sep 2021 23:36:29 +0000
Subject: [PATCH 04/15] Bump ansible in
 /automated_detection_testing/ci/detection_testing_batch

Bumps [ansible](https://github.com/ansible/ansible) from 2.9.20 to 4.2.0.
- [Release notes](https://github.com/ansible/ansible/releases)
- [Commits](https://github.com/ansible/ansible/commits)

---
updated-dependencies:
- dependency-name: ansible
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .../ci/detection_testing_batch/requirements.txt                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/ci/detection_testing_batch/requirements.txt b/automated_detection_testing/ci/detection_testing_batch/requirements.txt
index 698a3b0abf..4ec326670d 100644
--- a/automated_detection_testing/ci/detection_testing_batch/requirements.txt
+++ b/automated_detection_testing/ci/detection_testing_batch/requirements.txt
@@ -1,4 +1,4 @@
-ansible==2.9.20
+ansible==4.2.0
 ansible-runner==1.4.4
 attackcti==0.3.4.3
 boto3==1.11.0

From 1b572a1cc792e4e0e71a13c7f6840363ecf3a86b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Sep 2021 23:36:48 +0000
Subject: [PATCH 05/15] Bump ansible in
 /automated_detection_testing/ci/attack_range_for_testing

Bumps [ansible](https://github.com/ansible/ansible) from 3.1.0 to 4.2.0.
- [Release notes](https://github.com/ansible/ansible/releases)
- [Commits](https://github.com/ansible/ansible/commits)

---
updated-dependencies:
- dependency-name: ansible
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .../ci/attack_range_for_testing/requirements.txt                | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/ci/attack_range_for_testing/requirements.txt b/automated_detection_testing/ci/attack_range_for_testing/requirements.txt
index a368e7956a..0e8920b87c 100644
--- a/automated_detection_testing/ci/attack_range_for_testing/requirements.txt
+++ b/automated_detection_testing/ci/attack_range_for_testing/requirements.txt
@@ -1,4 +1,4 @@
-ansible==3.1.0
+ansible==4.2.0
 ansible-runner==1.4.7
 apipkg==1.5
 aspy.yaml==1.3.0

From a4b168a5349abf3a49fffb0737f0efd5a64f7d1a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 1 Oct 2021 23:00:45 +0000
Subject: [PATCH 06/15] Bump jsonschema from 3.2.0 to 4.0.1

Bumps [jsonschema](https://github.com/Julian/jsonschema) from 3.2.0 to 4.0.1.
- [Release notes](https://github.com/Julian/jsonschema/releases)
- [Changelog](https://github.com/Julian/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/Julian/jsonschema/compare/v3.2.0...v4.0.1)

---
updated-dependencies:
- dependency-name: jsonschema
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index a3a1089f22..29335aa3c4 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,7 +26,7 @@ importlib-metadata==4.8.1
 importlib-resources==5.2.2
 ipaddr==2.2.0
 Jinja2==3.0.1
-jsonschema==3.2.0
+jsonschema==4.0.1
 lockfile==0.12.2
 MarkupSafe==2.0.1
 more-itertools==8.9.0

From bcef2f20555cc39df12d733022be4c3947d5c386 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 1 Oct 2021 23:01:04 +0000
Subject: [PATCH 07/15] Bump azure-identity from 1.6.0 to 1.6.1

Bumps [azure-identity](https://github.com/Azure/azure-sdk-for-python) from 1.6.0 to 1.6.1.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](https://github.com/Azure/azure-sdk-for-python/compare/azure-identity_1.6.0...azure-identity_1.6.1)

---
updated-dependencies:
- dependency-name: azure-identity
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 automated_detection_testing/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 5de98d57b4..97cf2a6cf8 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -7,7 +7,7 @@ attackcti==0.3.4.3
 attrs==21.2.0
 azure-common==1.1.27
 azure-core==1.18.0
-azure-identity==1.6.0
+azure-identity==1.6.1
 azure-mgmt-compute==20.0.0
 azure-mgmt-core==1.2.1
 azure-mgmt-network==19.0.0

From 9b0f6d763ad68d9810cf8b30c83cd751640078a3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 4 Oct 2021 23:50:42 +0000
Subject: [PATCH 08/15] Bump ansible-runner from 1.4.7 to 2.0.2

Bumps [ansible-runner](https://github.com/ansible/ansible-runner) from 1.4.7 to 2.0.2.
- [Release notes](https://github.com/ansible/ansible-runner/releases)
- [Commits](https://github.com/ansible/ansible-runner/compare/1.4.7...2.0.2)

---
updated-dependencies:
- dependency-name: ansible-runner
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 automated_detection_testing/requirements.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 5de98d57b4..e32fbe9dcb 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -1,5 +1,5 @@
 ansible==3.4.0
-ansible-runner==1.4.7
+ansible-runner==2.0.2
 apipkg==1.5
 aspy.yaml==1.3.0
 atomicwrites==1.4.0
@@ -72,7 +72,7 @@ splunk-sdk==1.6.16
 tabulate==0.8.9
 termcolor==1.1.0
 toml==0.10.2
-urllib3<=1.26.6
+urllib3<1.26.8
 virtualenv==20.4.6
 wcwidth==0.2.5
 wget==3.2

From eb39fe5937b4e27309cff27dd315d9e899afcd4a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 5 Oct 2021 09:50:13 -0600
Subject: [PATCH 09/15] Updated PowerShell and Exchange Web Shell

---
 .../endpoint/detect_exchange_web_shell.yml    | 24 ++++---
 ...connect_to_internet_with_hidden_window.yml | 64 +++++++++----------
 ...s_powershell_process___encoded_command.yml | 23 ++++---
 3 files changed, 58 insertions(+), 53 deletions(-)

diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index bfbd39056f..2a83c2cf81 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -1,8 +1,8 @@
 name: Detect Exchange Web Shell
 id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
-version: 2
-date: '2021-03-09'
-author: Michael Haag, Shannon Davis, Splunk
+version: 3
+date: '2021-10-05'
+author: Michael Haag, Shannon Davis, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -12,7 +12,13 @@ description: 'The following query identifies suspicious .aspx created in 3 paths
   `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious
   .aspx file will likely look obvious on the surface. inspect the contents for script
   code inside. Identify additional log sources, IIS included, to review source and
-  other potential exploitation.'
+  other potential exploitation. 
+  It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. 
+  Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. 
+  Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. 
+  A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. 
+  If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. 
+  However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.'
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -31,10 +37,10 @@ known_false_positives: The query is structured in a way that `action` (read, cre
   is not defined. Review the results of this query, filter, and tune as necessary.
   It may be necessary to generate this query specific to your endpoint product.
 references:
-- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
-- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-- https://www.youtube.com/watch?v=FC6iHw258RI
-- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
+  - https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
+  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+  - https://www.youtube.com/watch?v=FC6iHw258RI
+  - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 tags:
   analytic_story:
   - HAFNIUM Group
@@ -79,4 +85,4 @@ tags:
   - Filesystem.file_hash
   - Filesystem.user
   risk_score: 81
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
index 72c9271cdf..7b5444fb72 100644
--- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
@@ -1,32 +1,34 @@
 name: Malicious PowerShell Process - Connect To Internet With Hidden Window
 id: ee18ed37-0802-4268-9435-b3b91aaa18db
-version: 6
-date: '2020-11-20'
-author: David Dorsey, Splunk
-type: TTP
+version: 7
+date: '2021-10-05'
+author: David Dorsey, Michael Haag Splunk
+type: Hunting
 datamodel:
-- Endpoint
-description: This search looks for PowerShell processes started with parameters to
-  modify the execution policy of the run, run in a hidden window, and connect to the
-  Internet. This combination of command-line options is suspicious because it's overriding
-  the default PowerShell execution policy, attempts to hide its activity from the
-  user, and connects to the Internet. Deprecated becaue hidden is not needed when
-  download file with System.Net.WebClient.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*"
-  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name
-  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  - Endpoint
+description: 'The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. 
+  Removed in this version of the query is New-Object.
+  The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
+    Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]")
+  | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
-references: []
+references: 
+  - https://regexr.com/663rr
+  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
+  - https://ss64.com/ps/powershell.html
+  - https://twitter.com/M_haggis/status/1440758396534214658?s=20
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -77,16 +79,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest
+  - Processes.process
+  - Processes.process_name
   - Processes.user
   - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Processes.dest
   risk_score: 81
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index e5242cc6de..0c9e87b655 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -1,22 +1,25 @@
 name: Malicious PowerShell Process - Encoded Command
 id: c4db14d9-7909-48b4-a054-aa14d89dbb19
-version: 5
-date: '2021-09-22'
+version: 6
+date: '2021-10-05'
 author: David Dorsey, Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint
-description: The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. 
-  The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-  During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use.
+  - Endpoint
+description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \
+  
+  The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \
+  
+  During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \
+  
+  Alternatively, may use regex per matching here https://regexr.com/662ov.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  by Processes.user
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
   Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id 
-  | regex Processes.process="[\-|\/|–|—|―][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\s+[A-Za-z0-9+/=]{5,}" 
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
+  | where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]")
   | `malicious_powershell_process___encoded_command_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: System administrators may use this option, but it's not common.
@@ -72,4 +75,4 @@ tags:
   - Processes.dest
   - Processes.process_id
   risk_score: 35
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file

From dc5033186d1001b4b9aeb12fb9a616907f42492c Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-156-55>
Date: Tue, 5 Oct 2021 16:18:46 +0000
Subject: [PATCH 10/15] Added detection testing service results inDetect
 Exchange Web Shell, ProxyLogon

---
 .../endpoint/detect_exchange_web_shell.yml    | 30 +++++++++++--------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index 2a83c2cf81..74000753e6 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -12,13 +12,19 @@ description: 'The following query identifies suspicious .aspx created in 3 paths
   `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious
   .aspx file will likely look obvious on the surface. inspect the contents for script
   code inside. Identify additional log sources, IIS included, to review source and
-  other potential exploitation. 
-  It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. 
-  Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. 
-  Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. 
-  A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. 
-  If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. 
-  However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.'
+  other potential exploitation. It is often the case that a particular threat is only
+  applicable to a specific subset of systems in your environment. Typically analytics
+  to detect those threats are written without the benefit of being able to only target
+  those systems as well. Writing analytics against all systems when those behaviors
+  are limited to identifiable subsets of those systems is suboptimal. Consider the
+  case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information,
+  a hunter can limit their analytics to systems that have been identified as Exchange
+  servers. A hunter may start with the theory that the exchange server is communicating
+  with new systems that it has not previously. If this theory is run against all publicly
+  facing systems, the amount of noise it will generate will likely render this theory
+  untenable. However, using the asset information to limit this analytic to just the
+  Exchange servers will reduce the noise allowing the hunter to focus only on the
+  systems where this behavioral change is relevant.'
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -37,10 +43,10 @@ known_false_positives: The query is structured in a way that `action` (read, cre
   is not defined. Review the results of this query, filter, and tune as necessary.
   It may be necessary to generate this query specific to your endpoint product.
 references:
-  - https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
-  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-  - https://www.youtube.com/watch?v=FC6iHw258RI
-  - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
+- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
+- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+- https://www.youtube.com/watch?v=FC6iHw258RI
+- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 tags:
   analytic_story:
   - HAFNIUM Group
@@ -85,4 +91,4 @@ tags:
   - Filesystem.file_hash
   - Filesystem.user
   risk_score: 81
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint

From 95bd6dd0b172f935e43127338aa94cb2e3c68739 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 6 Oct 2021 13:43:01 -0700
Subject: [PATCH 11/15] testing error

---
 automated_detection_testing/detection_service.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py
index d7cd1d841d..08de91ed31 100644
--- a/automated_detection_testing/detection_service.py
+++ b/automated_detection_testing/detection_service.py
@@ -148,7 +148,7 @@ def main(args):
                     detection_obj['tags']['dataset'] = datasets
 
                 with open(file_path, 'w') as f:
-                    yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True)
+                    yaml.dump(str(detection_obj), f, sort_keys=False, allow_unicode=True)
 
                 changed_file_path = 'detections/' + test['detection_result']['detection_file']
                 security_content_repo_obj.index.add([changed_file_path])

From 7fbc4b16501ba9f77513b2a0edabb34dd2ac3c67 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 6 Oct 2021 14:04:21 -0700
Subject: [PATCH 12/15] revert

---
 automated_detection_testing/detection_service.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py
index 08de91ed31..d7cd1d841d 100644
--- a/automated_detection_testing/detection_service.py
+++ b/automated_detection_testing/detection_service.py
@@ -148,7 +148,7 @@ def main(args):
                     detection_obj['tags']['dataset'] = datasets
 
                 with open(file_path, 'w') as f:
-                    yaml.dump(str(detection_obj), f, sort_keys=False, allow_unicode=True)
+                    yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True)
 
                 changed_file_path = 'detections/' + test['detection_result']['detection_file']
                 security_content_repo_obj.index.add([changed_file_path])

From 966f63d7f17b82e30f945511da1034b6eb5785b7 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 6 Oct 2021 15:17:00 -0700
Subject: [PATCH 13/15] duplicate

---
 .../network/dns_query_length_with_high_standard_deviation.yml  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml
index bcd3e1fbcf..a7eeba51fa 100644
--- a/detections/network/dns_query_length_with_high_standard_deviation.yml
+++ b/detections/network/dns_query_length_with_high_standard_deviation.yml
@@ -11,10 +11,11 @@ description: This search allows you to identify DNS requests and compute the sta
   standard deviation to show you those queries that are unusually large for your environment.
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
   where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")`
+  | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24
   | eval query_length = len(query) | table query query_length record_type count |
   eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length)
   AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev
-  | `dns_query_length_with_high_standard_deviation_filter` '
+  | `dns_query_length_with_high_standard_deviation_filter`'
 how_to_implement: To successfully implement this search, you will need to ensure that
   DNS data is populating the Network_Resolution data model.
 known_false_positives: It's possible there can be long domain names that are legitimate.

From 333552c326996535f8f1221d140edb4af1b7d90e Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Wed, 6 Oct 2021 15:25:22 -0700
Subject: [PATCH 14/15] version

---
 .../network/dns_query_length_with_high_standard_deviation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml
index a7eeba51fa..7104cb9a50 100644
--- a/detections/network/dns_query_length_with_high_standard_deviation.yml
+++ b/detections/network/dns_query_length_with_high_standard_deviation.yml
@@ -1,7 +1,7 @@
 name: DNS Query Length With High Standard Deviation
 id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
-version: 3
-date: '2021-07-21'
+version: 4
+date: '2021-10-06'
 author: Bhavin Patel, Splunk
 type: Anomaly
 datamodel:

From 9478681c7f88418af0b3ec82bbc1a6dc85a99518 Mon Sep 17 00:00:00 2001
From: divious1 <josehelps@gmail.com>
Date: Thu, 7 Oct 2021 14:54:45 -0400
Subject: [PATCH 15/15] removing name

---
 docs/_config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/_config.yml b/docs/_config.yml
index 31183e8a67..f834b25a9b 100644
--- a/docs/_config.yml
+++ b/docs/_config.yml
@@ -6,7 +6,7 @@ description: >- # this means to ignore newlines until "baseurl:"
   mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls.
   They include Splunk searches, machine learning algorithms and
   Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
-name: Jose Hernandez
+name: Splunk Threat Research Team (STRT)
 url: "https://splunkresearch.com"
 baseurl: "/" # the subpath of your site, e.g. /blog
 url: "https://splunkresearch.com" # the base hostname & protocol for your site, e.g. http://example.com